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ABSTRACT 

This thesis reports some results from studies of the Generalized 
Likelihood Ratio (GLR) technique to the detection of failures in an air- 
craft application. The GLR method can be used for detecting and identi- 
fying abrupt changes in linear, dynamic systems. It is designed to deter- 
mine simultaneously whether a change has taken place, the time that the 
change occurred and an estimate of the extent of the change. 

The technique is presented and its relationship to the properties of 
the Kalman-Bucy filter is examined. Under the assumption that the system 
is perfectly modeled, the detectability and distinguishability of four 
failure types is investigated by means of analysis and simulations. 
Detection of failure's is found satisfactory, but problems in identifying 
correctly the mode of a failure may arise. These issues are closely 
examined as well as the sensitivity of GLR to modeling errors. The ad- 
vantages and disadvantages of this technique are discussed and various 
modifications are suggested to reduce its limitations in performance 
and computational complexity. 
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CHAPTER 1 


INTRODUCTION 


1.1 Motivation 

This thesis is concerned with the detection of abrupt changes in 
linear dynamic systems. The problem is one with many implications for 
estimation and control. 

In many applications with Kalman-Bucy filtering [ 1 ] , very good 
performance can be achieved when the modeling of the dynamics is suffi- 
ciently accurate. For a number of important applications, however, a 
linear model is only a good approximation to the actual system dynamics 
over short time intervals. In others, a filter may be desired of lower 
dimension than that of an accurate model. The use s of the Kalman-Bucy 
filter in such cases frequently results in the divergence of the state 
trajectory of the system. Another important situation which also presents 
difficulties for estimation and control is the occurence of failures in 
a system. Such events can be troublesome even for systems which are other- 
wise modeled with high accuracy. 

One practical approach to the divergence problem is the use of 
adaptive estimation and filtering techniques which have been developed, 
as in [ 2 ] , [33. Although these techniques abound in the literature 
for cases where the changes in a system are slowly time-varying , only 
in the last few years has the problem of detecting sudden changes been 
addressed. 

Linear models of systems subject to abrupt changes can be used 
to study these problems involving modeling inaccuracies. They can also 
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be used to represent systems which may undergo failures m some of its 
components, such as sensors or actuators. The word "failure", as used here, 
refers -to abrupt changes in a system which need not be physical failures — 
e.g., a sudden, but infrequent, acceleration in a system when the esti- 
mation is based on a constant velocity model. 

With the greater availability and lower costs of digital hardware 
and software, more sophisticated design techniques can be studied in order 
to improve overall system performance and reliability. A recent survey by 
Willsky [ 4 ] describes a number of failure detection techniques and men- 
tions some of the characteristics and tradeoffs involved m the various 
methods discussed. The class of problems considered in [ 4 ] is that of 
linear systems, where some analysis is possible. In this thesis we look 
in some detail at the Generalized Likelihood Ratio technique I 5 1 , [6] . 

The Generalized Likelihood Ratio (GLR) technique consists of per- 
forming hypothesis testing on the residuals , or innovations process , of 
the optimal (Kalman-Bucy ) filter. The different hypothesis correspond to 
the behavior of the residuals assuming various failure models (including, 
of course, the 'no-failure' situation under normal conditions). The GLR 
formulation results in decision functions which allow us to extract a 
large amount of information (such as estimates of the failure mode, size 
and time of occurrence) about a failure, in addition to indicating whether 
a failure has occurred or not. A detailed analysis of the detection and 
identification performance of this technique is possible. In the following 
chapters we examine the performance of the GLR technique in a simple appli- 
cation. Finally, by offering a flexible set of implementations, the GLR 
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provides a practical method with which to study the many issues and trade- 
offs in the design of a reliable failure detection system. Some related 
work which this researcher has come across may be found in [ 7 ] , [ 8 ] , 
[9], [10]. 

Some important question concerning the capabilities of GLR for 
failure detection are of interest. In particular, we will look at several 
performance indices such as 

. false alarm rates 
. delays in detection 

. ability to distinguish among a variety of failure modes 
. sensitivity to modeling errors 

The tradeoffs to be resolved in obtaining optimum performance, with these 
considerations in mind, are trade-offs between complexity (of the failure 
detection design) and performance. For a technique like the GLR, issues 
such as these must be understood before the relative merits of hardware 
redundancy vs. 'analytical redundancy' can be* appreciated. The' ad- 
vantages and disadvantages of using hardware redundancy with voting 

decisions e.g.> comparing two or more sensors to determine their 
reliability — versus the use of more sophisticated (and generally, with 
higher computational costs) techniques must be considered. This work, 
hopefully, is a small step in such a direction. Further research should 
help 'identify situations where the added complexity is warranted. 

Basic to the GLR method is the formulation of the alternative hy- 
potheses by means of different failure models. It is therefore important 
to consider the relative distmguishability between failure of different 
modes when implementing the GLR detectors. It is important, for example. 
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to distinguish, a sensor failure from an actuator failure. Correct identi- 
fication of the mode of a failure is examined here, as well as the effects 
of errors in the modeling of the dynamic system. The performance of the 
detection system under various conditions is examined in the following 
sections m order to indicate where the main limitations of this approach - 
lie. At this stage in the developments of a methodology for the design 
of GLR failure detection systems , it was felt that it is important to con- 
sider these questions in the context of a simple but meaningful example. 

We have chosen a simplified model of the F-8C aircraft. 

It must be pointed out that in the following chapters the dis- 
cussion is concerned with a "worst-case" kind of situation. We are as- 
suming that there is only one set of measurements with which to work with. 
This is m contrast to the case where measurements are available from a 
set of redundant sensors [9 ], [10], 


Note: Some inaccuracies exist in the reported values of various quantities 

m [12] and [13]. This work should correct such instances, until 
a further update is ‘deemed necessary. 



1.2 THE GLR METHOD 


1.2.1 The Generalized Likelihood Ratio (GLR) Technique 

We will now describe the generalized likelihood ratio (GLR) tech- 
nique and the modifications which provide simpler formulations. The 
modifications allow some flexibility in the application of this approach 
to failure detection. 

Consider the dynamical system model 

x(k+l) = $<k)x(k) + B(k)u(k) + w(k) + f D (k,6) (1.1) 

z(k) = H(k)x(k) + J(k)u(k) + v(k) +• f (k,0) (1.2) 

s 

where x(k) e R n , u(k) £ R m , z(k) £ are the state/ input and output, 
respectively. The independent, Gaussian, white noise sequences v(k) and 
w(k) have statistics 


E(w(k) ) = 0, 

E(w(k)w(j) ' ) = Q(k) S . 

(1.3) 

E(v(k) ) = 0, 

E(v(k)v(j)') = R(k)6 k j 

(1.4) 


where 6^ is the Kronecker delta (in this context representing the unit 
pulse at time i=j). The terms f^ and f are used to model a variety of 
abrupt system changes. By 0 we denote the unknown time of occurrence 
of the failure. 

The types of changes which are the subject of this thesis are: 

1. Dynamics or State Jump 
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where V £ R n denotes the unknown direction and magnitude of the failure in 
state space and is defined above. This model can be used to describe 
the occurrence of a brief disturbance in the system such as a sudden noise 
spike well outside the given statistics for w(k) in (1.3), for example. 

Or, it can also describe momentary deviations of the control action away 
from the expected B(k)u(k). Notice that this includes possible changes 
rn either the control signal u(k) or the gain through which it enters 
the system B(k), or both. The modeling of V will be discussed later. 


2. Dynamics or State Step 


f D (k,e) - w k+lj0 


Here Cf. . 


is the unit step function 


( 0 i < j 

( 1 1 1 3 


( 1 . 6 ) 


(1.7) 


This model can be used to represent the effect of a failed actuator in a 
control system, whereby an additional constant, driving signal enters the 
system thus causing the state to move away from a prescribed trajectory. 
For example, a sudden increase in demand in a power generating system, 
where the demand acts as a control, due to an emergency situation perhaps 
due to a failure or shutdown in one of .the plants. Or, a constant bias 
in the control signal of a digital flight control system of an aircraft 
which can be the result of some component malfunction. In addition, m 
many cases more complex failures (such as scale factor changes) resemble 
steps over periods of time, and a detector looking for a step can be used 
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to detect them . 

3. Sensor Jump 

f (k,0) = v5 k0 (1.8) 

This can be used to represent bad data points (outliers) in the measure- 
ments of the output variables. By detecting such points one can prevent 
the error in the state estimates that otherwise results in the estimation 
subsystem (e.g. , a Kalman filter). 

4. Sensor Step 

f s (k ' 9 > “ w ke < l -»> 

This models the onset of a bias in a measuring instrument. Again, this is 
an important situation where detection of the failure makes possible the 
removal of the consistent errors which result in the estimation of the 
process variables. The importance of being able to detect failures in 

t 

the measuring system grows if one considers the use of feedback involving 
the estimated state variables. Again, one can use a model such as (1.9) 
to approximate a scale factor change over a period of time. 

We recognize that these models are highly simplified descriptions 
of actual failure situations. However, they allow for detailed analysis 
in the GLR context and thus provide the opportunity to gain valuable in- 
sight into the workings of this technique. This is necessary before we 
can move on to analytically more complicated failure models. 

Other failure modes that are of interest and that can be the subject 


of future study are: 
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5. Hard-over Actuator 

f (k,9) = AB(k)u(k><r ( 1.105 

u Jt+1 , U 

Here AB(k) is an unknown change in the effectiveness of one or more of 
the actuators. 

6. Increased Actuator Noise 

f D (k,e) = ?(k)o k+lfQ d.ii) 

where £ is a zero-mean, white noxse sequence with unknown covariance 5.. 

7. Dynamics Shift 

f D (k , 0 ) = A$x(k)a k+1 ^ e (1.12) 

where A§ is an unknown shift in the plant dynamics. 

8. Hard-over Sensor 

X (k,8) = [AHx(k) + AJu(k) ]0 _ (1.13) 

s k,0 

where AH, AJ -represent scale factor changes in the sensors. 

9. Increased Sensor Noise 

fjk,e) - SOOa k>0 (1.14) 

This list of possible failure models is not intended to represent 
all cases of interest. Nevertheless, it is clear that these cases and 
combinations of them provide a fairly broad range of failure modes on 
which to base a study of failure detection techniques. It is also worth 
reiterating that failure models 1-4 may be viewed as having models 5-9 
embedded in them, although admittedly not in a trivial way. For example. 
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models 5, 7 and 8 are, in some sense, 'dynamic biases' which, are not radi- 
cally different from models 2 and 4 when x (k) and u(k) remain approximately 
constant over the detection interval. This may be the case in systems 
with very slow dynamics. Alternatively, the increased noise models 6 and 
9 can be thought of as random sequences of jumps, as in modes 1 and 3, 
given the proper distribution of their magnitudes V and times of occurrence 
6 . 

Let us now consider the detection of such failures. The 'basis for 
the GLR approach, given in 'Willsky- Jones [6], is as follows. Design a 
Kalman filter based on the "no failure" hypothesis (f^ = f = 0) . The 
filter equations are 

x(k+l|k) = $(k)x(k|k) + B (k) u (k) (1.15) 

x(k|k) = x(k|k-l) + K(k)y(k) (1.16) 

Y(k) = z(k) - H‘(k)x(k|k-1) - J(k)u(k) ' (1.17) 

where x(ijj) is the optimal (‘minimum mean -squared error) estimate of the 
state at time i based on measurements up to, and including, time j. The 
Y(k) are the zero-mean, Gaussian innovations process (the residuals) 
associated with the optimal filter. The optimal filter gain sequence 
K(k) is calculated 'from the equations 

(1.18) 
(1.19) 


P(k+ljk)'= $ (k)P(k|k)<i>« (k) + Q(k) r 
P(k|k) = P (kjk-1) -- K (k) H (k) P (k | k-1) 

V (k) = H(k)P(k|k-l)H'(k) + R(k) = E (y(k)y' (k) ) 


( 1 . 20 ) 



- 21 - 


K(k) = P(klk-1)H' (k)V _1 (k) (1.21) 

with the appropriate initial conditions 

x(o|o) = E(x(0)) = sc (1.22) 

P (0 1 0 ) = E([x(0) -X Q ][x(0) -x Q 3') = ¥ . (1.23) 

Now suppose that an abrupt change, corresponding to one of the 
above models, takes place at time 0 and from then on the system is 
described by (1.1) and (1.2) . 

By the linearity in the assumed system model one can then obtain 
an expression for the filter residuals 

Y (k) = Y (k) + s (k,6) (1.24) 

where Y is the "no failure" innovations with the statistics given above, 
and s(k,0) is the effect of the failure on the residual. The form that 
s(k,0) takes is different for each of the failure models. In particular, 
for models 1-4 which concern us here, one can write 

s(k,0) = G^(k,0)V (1.25) 

where i e {l,2,3,4} denotes the failure type, and G i (k,0), called the 
failure signature matrix , can be precomputed (see Appendix A) . This matrix 
gives the effect of the failure on the residual and, as one would suspect, 

„ plays a crucial role in the development and analysis of the GLR system. 

The failure detection problem can be formulated as a decision 
to be made between competing hypothesis (Schweppe [14], Van Trees [15]) . 

H q s no failure has occurred (0 > k) 
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: a failure of type i has occurred (0 <_ k) 

where 0 and V are regarded as unknown parameters (i .e . , no prior distri- 
butions are postulated) . The GLR approach attempts to isolate the differ- 
ent failures by using knowledge of the different effects that such fail- 
ures have on the system residuals, An equivalent formulation of the 
problem, which is more useful for our purpose, is the following: 


H q : y(k) = y(k) (1.26) 

H •* Y-(k) = y(k) + G i (k,0)V (1.27) 

The generalized likelihood ratio test (Van Trees [15] ) can now 
be applied and we obtain a decision function based on the innovations 
sequence. Given this sequence , the procedure consists ,of computing the 
maximum likelihood estimates (MLE’s) of 0 and V assuming that a failure 
has occurred (for each type -of failure) . Substituting these values into 
a likelihood ratio test, one can then proceed 1 ' to 'decide- on the hypotheses. 
In other words, given the estimates 

A /V 

8(k), V(k) = arg max p(Y(l), . ../ Y< k ) 1 H - 0=0, V=v) -(1.28) 

e,v 1 

where p denotes the probability density function , the generalized likeli- 
hood ratio is, defined by 


b; (k) 

i 


A A 

•p(Y(Df ...,,Y(k)’|H , 0=0 (k) , v=v (k) ) 
- (Y ^ 1) ^ y Y(k) |h q ) 


(1.29) 


A decision between H Q and Ih can then be made by means of a decision rule 
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H. 

> 1 

(1.30) 

max L (k) D 

i 1 < 

H o 

where T) is appropriately chosen as a design parameter in 
the goals of the detection system. 

comformity with 

Without loss of information, one can simplify the 
(1.29) by taking logarithms 

(k) = 2 In L (k) 

k 

decision function 

-y: y* (j)v _i {j)Y{j) 

k 

(1.31) 

X ' , ~ ~ -1 

A A 

-/ , hr(-i) - G.(D,0Cj))v(j)]'v (j) [y(j) - 

j=i 

- G i (j r 9(j))V(j)] 

A 

/V 

Here V(k) can be expressed explicity as a function of 0^ (k) 

A , A A 

\t(k) = Ck (k, G^k)} d^Ck, G^Ck)) 
where CMk,0) is the deterministic matrix 

^ -i 

(1.32) 

Ck (k,0) = / (i ,9)v (j)G i (j,9) 

(1.33) 

- 1 j=l 1 


" and d^(k,0) is a linear combination of the residuals 

k 

- 

di ( k,0) = (j,9)V~ 1 (j)Y(j) 

j=l 

(1.34) 
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Finally, the log-likelihood ratio can be given by 

£ (k,0) = dMk,0)c“ 1 (k,e)d i (k,e) (1.35) 

/s ~ 

and the MLE 6. (k) is the value of 6 < k that maximizes 

i — 

t. (k,0.) = max d' (k,0)C ^(k,0)d(k,0)^ (1.36) 

1 1 e 

The decision rule becomes 

H. 

i 

max t. (k, 0. (k) ) ^ £ = 2 £nr] - (1.37) 

i 1 1 < 

H o 

A failure of type i is declared if £ (k,0(k)) exceeds the threshold e. 
Some remarks are in order here. 

• In equations (1.33) and (1.34) many of the terms are zero, 
since G(j,0) =0 for j<0. 

• The si gnat Tore matrices G^(k,0) can be precomputed and stored, 
or they can be generated recursively (see Appendix A) . 

• The equations for d^(k,0) can be interpreted as defining 
matched filters for a failure of type i (for more on matched 
filters, see Van Trees [15], Schweppe [14]). 

• As Figure 1.1 illustrates, this detection scheme involves 
the implementation of a growing bank of matched filters for 
different 0. To avoid this complication, the maximization 
in (1-36) is restricted to a "data window" such that 0 lies 


in the interval 




Figure 1,1 Full GLR Detector Scheme with Growing Bank of Filters 
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k-M < 0 <_ k-N (1- 38) 

More on this and on the selection of 11, N follow. 

• The £^(k,0) can be updated, by means of a recursive algorithm, 
for every new residual Y(k) produced in the Kalman filter. 

The basic recursion is given by 


C. (k,6) = C. (k-1,0) 

1 X 

+ GMk,0)V 1 (k)G i (k,0) 

(1.39) 

a. (k,0) = a. (k- 1 , 0 ) 

X X 

+ GMk,e)v _1 (k)Y(k) 

(1.40) 


for each 0 in (1.38). Note that the Ch(k,8) does not depend 
on y (k) and can be precomputed and stored. 

• If the system and filter are time-invariant, G(k,6) and 
C(k,0) depend only on r = k-0. This means that only M-Ntl 
of each need to be generated when a window (1.38) is_used. 
This reduces the computational burden significantly. 

i 

* The information generated by the GLR system can be very use- 
ful for condensation schemes to follow the detection of a 

A A 

failure. The estimates 0 and V in particular can be used 
to determine updates for the filter estimate and covariance 
matrix, for example, in order that accurate functioning may 
continue. This would allow for the detection of multiple 
failures since the residuals are made to conform to the new 
situation which has been compensated for. More on the esti- 
mate and covariance incrementation can be found in Willsky— 
Jones [ 6 ] . 
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As mentioned at the beginning of this section, there are modifications 
which can be incorporated into the GLR method. Each of these reflects 
different assumptions made on the types of failure of interest. In the 
preceding, the failure vector has been allowed to take on any value in 
R n or R^, for dynamics or sensor failures respectively. It is often 
the case however, that one has additional information concerning the pos- 
sible failure modes. 

In some cases one may, by physical considerations, conclude that a 
particular failure mode must necessarily be restricted to one of a par- 
ticular set of directions in state or output space. .This is the case, 

r 

for example, when we know that only a particular actuator or sensor is 
subject to the assumed possible failures. This leads to the constrained 
GLR (CGLR) formulation, in which we constrain V in the form 


V = 3f . f . e {f. , ... , f > ’ (1-41) 

3 3 1 r 

where the f ^ are the hypothesized failure directions and 3 is the un- 
known failure magnitude. One then computes 


t <k,0> 


[fM i (k,G)3 2 

f'.C. (k,0) f. 
3 1 3 


(1.42) 


which gives the log- likelihood ratio for a failure of type i in the di- 
rection f . (There may be different failure directions for different 
3 

failure types, which implies that not all i-j pairs need be considered.) 

* 1 

AAA 

We then compute the maximum likelihood estimates (MLE's) i, j, 0 and the 
MLE of the failure magnitude 
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e(k> 


£ j(k) 

f 1 

3 (k) 


A 

d i{k) 

C i (k) (k '^ (k) } f j (k) 


(1.43) 


By further constraining the failure such that the magnitude is also 

fixed 


V £ {v . ... , V } 

1 s 

we obtain the Simplified GLR (SGLR) formulation. 


(1.44) 

Here one computes 


Z. (k,0) =2V.d. (k,0) - v\C. (k, 6 )V. 
13 3 1 3 1 3 


(1.45) 


and uses the largest of these to determine the presence of a failure and 
the best estimates of i f j and 0. In contrast to these two restricted 
GLR techniques, we will refer to the original version, where no infor- 
mation about V is assumed, as 'full* GLR. 

This completes the introduction of the GLR-based approach to the 
detection of failures. The basic modeling assumptions, concerning the 
types of failure modes to which our attention will be directed, were 
presented. A hypothesis testing problem was formulated, a solution to 
which resulted in what we will refer to generically as the GLR system. 


It was also seen how variations of the main formulation result by im- 
posing some further constraints on the failures to be detected. This 
provides a useful way to incorporate additional information that one 
might have on the possible failures in a manner which may simplify the 
procedure and alleviate the computational requirements . 

We have not yet suggested what the expected performance of such a 
system might be or what appropriate measures of such performance are. 
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We will be dealing with questions like these throughout the rest of this 
thesis . But first we will present the system to which we will apply our 
failure detection scheme and on which our results are based. This problem 
has, in effect, been the "test-bed" for assessing GLR performance character- 
istics . 

1.2.2 Application Problem: The Reduced F-8C Model 

The essential concepts in the GLR technique for failure detection 
have been introduced in the previous section. In addition to our analysis 
of the performance, and limitations, of such a system, extensive use of 
simulations has been made. No attempt was made to generate complete 
-and statistically significant data, or to provide any kind of final test 
of the system. The simulations did provide some confirmation of the 
analysis and helped us to develop intuition into GLR behavior. Consider- 
able insight into the dynamics of failure detection was the result. 

The simulations were made by applying the GLR system to a simplified 
model of the longitudinal dynamics of the F-8C aircraft. The model on 
which the detector design was based is a second-order, discrete-time version 
of the aircraft longitudinal dynamics at several particular flight con- 
ditions . 

The motivation for using this model lies in the need to have a model 
of a concrete, physical system on which to implement the GLR detectors that 
would provide some common grounds for comparisons. This model provides 
a compromise in complexity between realism on the one hand and the 
amount of computation and ease of interpretation on the other. At this. 
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stage in the development and study of the GLR approach to the detection 
of failures, some qualitative results were needed in order to understand 
its structure and performance characteristics. 

Our model is derived from the continuous time representation of the 
F-8C longitudinal dynamics, linearized about flight condition 11. Flight 
condition 11 corresponds to level flight at an altitude of 20,000 feet, 
at a speed of Mach 0.6 in cumulus clouds. It can be represented by a 7- 


dimensional model: 

x(t) = Ax (t) + Bu(t) + G^Ct) (1.46) 

where 

x^ = q, pitch rate rad/sec 

x 2 = v, velocity - = Mach no. x speed of sound] ft/sec 

x 3 = a ' ( an 9le of attack) - (trim value) tttt. . . . . . rad. 

pitch attitude rad. 

x = 6 , (elevator deflection) - (trim value) rad. 

o e 

x = Se , commanded elevator angle ....rad. 

o c 

x^ - w, normalized wind disturbance rad. 


State variables x,. = <5^ and — <5 take into account the actuator dyna- 

c 

mics. The control variable is 

u(t) = rad/sec (1.47) 

c 

The matrices A, B and G are 7x7, 7x1 and 7x1, respectively. The wind 
disturbance, x^=w , is modeled by the output of a first-order linear system 
driven by the white noise process c, (t) . The wind model arises from a 
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given power spectral density 

[to / w = x ? 3 (1.48) 

For flight condition 11, which is considered here, we' have 

k = 2,500 ft. (for altitudes > 2500 ft.) 

V Q = (0.6) (1,036.93 ft. /sec) = 622.15 ft. /sec 
C = 15 ft. /sec (cumulus clouds) 
to (rad/sec) 

\ 

which determine the values of G and statistics of £(t) in (1.46). 

There are five sensor outputs given by z 

z(t) = Cx(t) + n(t) (1.49) 

where 

z„ “ z , pitch rate measurement 

1 q 

z^ - Z v , velocity error measurement 

Z 3 Z 0 , pitch attitude measurement 

z = z 

4 6 f elevator angle measurement 

e 

z —• z 

5 to , normal acceleration measurement 

z 

C is 5x7 matrix and n (t) contains the five measurement noises which are 
white, mutually independent random variables with given statistics 



E(n(t)) = 0 

E(n (t)n' (t) y = E5(t-s) 


(1.50) 
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Reduction to a Two-Dimensional Model 

Given this model, a simplified two-dimensional representation was 
obtained, (More on the F-8C model can be found in Athens & Dunn [163). 

Some of the steps and considerations taken in the reduction of order of the 
model were: 

• ignoring the input dynamics represented by and x^, as they 
are not the main variables of interest in an aircraft dynamics 
model . 

• eliminating x^, the wind disturbance, as a variable and modeling 
its effects on the remaining ones by a white noise process (i.e., 
we ignore correlation in the wind) . 

• selecting the variables with the highest signal-to-noise ratios 
among the observations and ignoring the rest. 

• using common sense and engineering intuition -to correct and/or 
add for any other significant interactions. 

The two state variables which were finally selected are 

x^ = q, the pitch rate 

= a, angle of attack - trim value 

The last step was obtaining -the corresponding discrete-time model 
to facilitate implementation on the digital computer as well as being 
consistent with our intended discrete-time analysis . A discretizing time 
step of T = 0.03125 sec (1/32 sec) was used. The resulting model for 
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flight condition 11 was 

x(k+l) = $ x(k) + Gw(k) 
z(k) = Hx(k) + Dv(k) 

where G, H and D are the 2x2 matrices', 



‘0.98258 

-0.14649' 



~0 .022596 

0.0 

$ = 



/ 

G = 




_0. 03059 

0.97193_ 



_0. 004328 

0.000226, 



1.0 

0.0 


‘0.00873 

0.0 " 

H = 



, D = 




_ 0.0 

16.154. 


.0.0 

0.06. 


The eigenvalues of are 


A($) - 0.977 + j (0.0667) 


and so the system is a- stable one. The sequences w(k) and v(k) are 
mean, independent, white Gaussian sequences with unit covariance 


E(w(k)w(j) ') = l6 , 



fo k / j 

(l k = j 


E(v(k)v(j) ' ) = 16, . 

k] 

Note that the system (1.51), (1.52) is * equivalent to that of (1.1), 
if we set Q and R from (1.3), (1.4) to be 


Q - GG' , R = DD' 


(1.51) 

(1.52) 


(1.53) 

(1.54) 
zero 


(1.55) 
( 1 . 2 ) 

(1.56) 


The first step in designing a GLR system is obtaining the Kalman- 
Bucy filter (KBF) corresponding to the unfailed system. For the system 
given by (1.51) -(1.55) , the steady-state version of the filter described 
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by equations (1.15) - (1.21) of the previous section gives us 

x(k|k-l) = $x (k-1 |k-l) (1.57) 

•x(kjk) = x(kjk-l) +Ky(k) (1.58) 

with 

Y (k) = z(k) - Hx (k |k— 1) (1.59) 

K - PH'V^ 1 (1.60) 

The filter error covariance matrix P = lim P(k[k-1) is the steady-state 

k-*» _ 

solution Of equations (1.18), (1.19) and gives K, the constant, steady- 
state Kalman gain matrix. The covariance matrix for the residuals, V, is 
then given by (1.20) 

V = HPH* + DD' (1.61) 


11 . 


The resulting matrices K, P and V are as follows for flight condition 


7.5351 x 10 
1.3527 x 10' 


4.6257 x 10 
1.2748 x 10 -2 . 


5.6311 x 10 
1.0891 X 10' 


1.0891 X 10 
2.2130 x 10 


[6.3933 10~ 4 1.7593 10~ 3 " 

-1 _3 

^1.7593 x 10 9.3747 x 10 J 


(1.62) 


The predicted estimate, as given by equations (1.57)-(1.59) , can be put 
in its recursive formulation 
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x(k+l|k) = 3>x(k|k-l) + $K[z(k) - Hx(k|k-1)] 

= $ (I-KH) x (k | k-1) + Kz'(k) (1.63) 

with $ (I— KH) given by 

_ '0.2620 -0.8505' 

§(I-KH) = (1.64) 

—0.1239 0, 7489_ 

The eigenvalues of the filter are 

! 0.09966 i=l 

(1.65) 

0.91188 i=2 


Notice the absence of the control terms in the system (1.51) , (1.52) 
and filter (1.57) - (1.59). They were not included .since their effect on the 
residuals is cancelled in the KBF. The detector is therefore not affected 
and the analysis is simplified somewhat. 

As was stated m section 1.2.1, our discussion on the performance 
of the GLR system will be. limited to the detection of failures that can 
be represented by the failure models 1-4. Recall the four basic failure 
modes as applied to the simplified aircraft model. 

1. State (Dynamics) Jump 

x(k+l) = $x(k) + Gw(k) + v6_ , . Q (1.66) 

Kt JL f V 

2. State (Dynamics) Step 

x (k+1) = $x(k) + Gw (k) + VO Q (1.67) 

k*r 1 / V/ 

3. Sensor Jump 

k,6 


z(k) = Hx(k) + Dv(k) + vS. 


( 1 . 68 ) 
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4. Sensor Step 

z(k) - Hx(k) + Dv(k) + va k 9 (1.69) 

where V is the failure and 0 the time at which it occurs . 

In the design of a GLR system under the assumptions of these failure 
models, some thought should be given to the proper use and interpretation 
of the failure vector V. For the cases where the constrained or simpli- 
fied GLR are adequate or desirable this question is of particular im- 
portance. As their formulations implicitly depend on the hypothesized 
direction and/or magnitude of V, it is reasonable to expect that the 
careful selection of this failure vector will result in improved overall 
performance of the detection system. Ultimately, this is a question of 
physical and engineering considerations. 

For the simulations, the failures were taken in orthogonal directions 
in failure space, V e R n for 1, 2 and V e R P for 3, 4 (n=p=2 for our' 

simplified model). - ' Thus, vectors of the form (V 0) 'and (0 V ) were 

1 2 

considered for a range of values of V , V thought to be of most interest. 

» i — 

Let us take a closer look at the kinds of situations that these failures 
might represent in the case of the simplified F-8C model. 

Recall that = q is the pitch rate and that = a is the angle 
of attach deviation from the trim value. Thus a state jump of the form 
(V/ O') or a state step of the form’ (0 V^) might be used to model the 

effect of a -sudden -wind shear that leads to an increasing angle- of attack. 

On the other hand, a jump of the form (0 could be used to model a 

relatively long-term upward or downward gust that initially manifests 
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itself as a shift in tt. A step of the type (v^ 0) could arise from an 
elevator failure. 

In the observation equation, failure models 3 and 4, we have a simi- 
lar situation. A failure (\)^ 0) may model a bad data point in the measure- 
ment of q for the jump case (3) , or it may represent a permanent bias in 
that measurement for thg case of a step (4) . Such a bias might be the 
result of a component failure in a sensor, for example. By analogy, the 
same may be said about a (O.v^) failure', which then refers to the measure- 
ment of a. 


Table 1.1 summarizes the failure schedule implemented in the simu- 
lations. State and sensor failure magnitudes are given in terms of the 
standard deviations of the noises affecting each variable (1 O equals 


one standard deviation of the noise) . 
will denote the standard deviations of 


For clarification purposes 0 , O 

q a 

the noise m the dynamic equations 


for q and a, respectively, and O', O' will denote the analogous noise 
level for the measurements of q and a. In table 1.2 the values of these 


Id noise levels are given. 


DETECTOR AND 
FAILURE TYPE 

STATE JUMP 

STATE JUMP 

SENSOR JUMP 

SENSOR STEP 



TABLE 1.1 Set of Failures Simulated 
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STATE NOISE 

SENSOR NOISE 

a 

a 

a* 

a* 

<1 

a 

. . 1 

a 

1 std. dev. = 

1 std. dev. = 

1 std. dev. = 

1 std. dev. = 

-2 

-3 

-3 

-2 

2.2596 x 10 

4.3335 x 10 

8.7298 x 10 

6.0 x 10 


TABLE 1.2 Noise Levels in Standard Deviations 

For jump failures nothing under la was looked at since those jumps 
would be undistinguishahle from the noise. Such failure magnitudes were 
considered for step failures since they are detectable because their sus- 
tained presence provides more information as time passes . This 'will be 
seen in more detail when we examine the signature matrices (k, 0) for 
the various failure modes. 

This completes our presentation and description of the system 
model with which our numerical results of the simulations were generated. 
We will have more to say as we go along. 

1 ‘ 3 ' SLimEX QF-T.HE.gtR APPROACH AND. ..OVERVIEW 

In the introduction we tried to define the goals of this effort: 
to evaluate the performance of the GLR-based technique for the detection 
of failures in the light of some analysis, and 'experience ' via simulations 
its application to a specific dynamical system. 

In section 1.2.1 the basic modeling assumptions and issues that will 
concern us here were presented. A number of failure models were intro- 
duced, and what we will refer to as the GLR system was developed for the 
cases to which this work will be restricted. A simple but adequate (for 
purposes) dynamic system model was discussed. 
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In the following we examine the performance of a GLR detection 
system as applied to a specific example. In combination with some anal- 
ytic performance measures developed by Chow [12 ] and Willsky-Jones [ 5 ] , 
the aim here is to develop insight into the practice of failure detection 
and the difficulties that arise. 

Chapter 2 will present some results obtained by a straightforward 
application of the method m section 1.2.1 to the system presented in 
.1.2.2. In a sense, conditions are set to be ideal: the GLR detection 
system is based on exactly the same dynamics as the system which under- 
goes the failures. Furthermore , the correct detectors for the particular 
failure modes treated are implemented. After some discussion in section 
2.2 on the question of performance measures and GLR characteristics , 
in section 2.3 some actual results are presented and interpreted , providing 
an initial evaluation of the failure detecting capabilities of the GLR. 

Chapter 3 takes a look, at some of the limitations on the capability . 
of the GLR technique to correctly detect and identify the actual failure 
mode present in a system. The question of distinguishing among several 
possible failure modes is of central importance here. Some simulation 
results from the GLR implementation m Chapter 2 are discussed. Knowledge 
of these limitations obtained by increasing our understanding of the 
method, suggests ways of ' overcoming some of the difficulties and of 
realistically evaluating our ability to handle failures. 

After some familiarity with the GLR system performance character- 
istics is developed in Chapters 2 and 3, in Chapter 4 our attention 
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focuses on the sensitivity of such performance to modeling errors. Im- 
portant questions on the final relevance of the GLR system for reliable 
failure detection in applications where modeling errors may be substantial 
■are raised and an attempt is made to look for a way out of the difficulties. 

Finally, in Chapter 5, we try to put our results in perspective and 
to draw some conclusions. Discussion of the merits and drawbacks of the 
GLR approach is followed by specific suggestions on means to overcome 

the major limitations on the achievable performance levels. Areas of 

*\ 

potential and of promising future work are pointed out. 



CHAPTER 2 


CORRECT DETECTION UNDER MATCHED CONDITIONS 

2.1 MATCHED CONDITIONS AND CORRECT DETECTION 

The motivation for the use of the GLR technique was explained in 
Chapter 1 and a framework for its use in the area of failure detection 
was developed. As a tool for detecting and identifying the events that 
we characterize as failures , the GLR technique offers some advantages . 

The estimation of 8 and for example, provides some essential information 
if compensation is required subsequent to the detection of a failure. 

The possibility of some analytical evaluation of the anticipated per- 
formance is another reason for the appeal of this approach. 

In this chapter we examine the performance of an application of 
the full GLR technique of section 1.2.1 to the detection and identifi- 
cation of failures in the system presented in section 1.2.2. The terms 
'matched conditions' will be used to denote the modeling assumptions on 
which the detection system design is based. We assume perfect knowl- 
edge of the system parameters and noise statistics. This is m con- 
trast to the situation referred to as 'mismatched conditions', considered 
in Chapter 4, where modeling errors are allowed. 

The main purpose here is to develop some intuition on the theoreti- 
cally optimal performance that can be extracted from a simple appli- 
cation of the GLR method to the detection of failures . Our approach is 
qualitative in nature. It is meant to complement the work done by Chow 
[12] of a more quantitative kind. In addition to the overall understanding 


- 41 - 




-42- 


we expect to develop, this will also provide a reference performance level 
with respect to which one can measure the degradation in detection and identi- 
fication, which takes place in a more realistic environment, where the system 
does not perfectly correspond to the model. 

Furthermore we also explicitly assume that the failure mode is 
known and, consequently, that we are able to implement a GLR detector 
based on that mode. This is what is meant by correct detection, and 
no judgment on the resulting performance is implied. It is clear that 
if we are certain about the kind of failure anticipated, then we can do 
at least as well, if not better, as when the failure type must first 
be isolated. Chapter 3 considers the difficulties that may arise when 
the 'failure mode is unknown. 

The results under these conditions indicate how well the GLR 
detection system can perform in under ideal conditions. Therefore 
expectations about -what can,* and cannot, be achieved will be firmly 
grounded. Section 2.2 presents some measures with which to evaluate 
the detection performance of the GLR technique. In addition, we begin 
to .look at some questions on the detectability of the 'different failure 
modes. Then, in section 2.3, some results are shown from an application 
to the simplified F-8C model. Section 2.4 summarizes the results. 

2.2 THE DETECTION PERFORMANCE OF THE GLR 

2.2.1 Performance Analysis 


We now begin our study of the performance of a GLR failure detection 
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system. In order to evaluate the performance and reliability of such a 
system, we need to select some indices that measure its quality. We look at 
the decision procedure in the GLR technique and at ways to characterize 
its dynamic behavior. This helps us to choose the detector parameters 
and to -resolve tradeoffs which are inherent in this method. Our aim is 
to understand well how the GLR technique works. 

If a condition of failure exists, changes are induced in the 
behavior of the innovations of the Kalman filter. The GLR detectors 
continually compute the correlation between the actual residuals and 
their anticipated behavior under each of the failure hypotheses. This 
concept is expressed by equations (1.26), (1.27) and (1.33)-(1.37) , 

A 

which describe the GLR detectors and procedure. The quantity (k ,0) 
is a normalized measure of that correlation between the system residuals 
and the residuals under the best estimate of the failure mode. 

It is clear that for any configuration of the parameters 
{m, N, i, e) which specify the GLR detectors, it is the statistical be- 
havior .of the random variable £^(k,0) which defines the performance 
of the system. Some of the- features or characteristics of this behavior, 
such as delay times to detection and false alarm rates, for example, 
can be studied by examining jthe evolution in time of the distribution 
of values that this variable takes under various conditions . Many in- 
teresting and important questions can be formulated in terms of certain 
events. These questions can then be transformed into the calculation of 
probabilities. Such an analysis allows us to study in detail the numerous 
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tradeoffs that one faces xn designing an acceptable failure detection 
system. 

Consider now a situatxon where a GLR detector is desxgned for 

the failure mode which coincides wxth that of the actual failure taking 

place. For simplicity we will drop i e {l, 2, 3, 4}, the failure type, 

in the following discussion. In [12] Chow shows that for the full GLR 

2 

£{k,0) is a non-central, chi-squared (X ) random variable with n degrees 

of freedom for state failure detectors , or P degrees of freedom for sensor 

failure detectors (n is the dimension of the state and p the number of 

2 

measurements). The mean or expected value of -£(k,0) is n + 6 (or 
2 2 

p + for the sensor cases) where 6 , the non-centrality parameter , is 
given by 

<$ 2 = 6 2 (k,0) = V'C(k,0)V (2.1) 

\ 

when a failure of size V occurs. 

This can be readily seen by examxning the equations from the 
GLR. From section 1.2.1 we recall 


Y(k) = Y(k) + G(k,0) V 


d( k,0) = ? ^ G' (j,0)V~ 1 (i)Y(i) 
k 


'■ ( k,6) = ^ G' <j,0)V 1 


(3)G(j,0) 


and 


( 2 . 2 ) 

(2.3) 

(2.4) 


£(k,0) = d' (k,0)C _1 (k,0)d(k,0) 


(2.5) 
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Notice that in >(2.3) and (2.4) the^ lower limit in the summation has been 
replaced by 0. 

By expressing (2,3) in terms of Y(^) one gets 


d(k,8) = d(k, B) + C <k,6) V 
k 


d(k,0) 


= (D,0)V _1 (i 

• 3=6 


)Y<j) f {d(k, 0 ) |y = y} 


’ ( 2 . 6 ) 

(2.7) 


This follows by simple substitution of (2.2) into (2.3). Here d(k,0) 
is a zero mean random vector with covariance matrix C(k,9) , as may be 
easily verified given the properties of Y(k) . When a failure is present, 
d(k,0) has the same covariance , but the mean value becomes C(k,0)V as 
(2.6) shows. Finally, using (2. *6) in equation (2.5) 

£(k,0) = [d (k, 0) + C(k,0)v] ’cT-^k/Q) Id(k,0) + C(k,0)v] 

= &' (k,{3) C _1 (k,0 ) d(k,0) + VC (k,e)C _1 (k,e)d(k,0) 

’ + d r (k,e)c“ 1 (k,e)C(k,6)v + VC* (k,0 ) C~ 1 (k,0) C (k, 0) V 
= £(k,0) + 2Vd(k,0) + V’C(k,0)v (2.8) 


where 

•£(k,0) = d‘ (k,e)c" 1 (k,6)d(k,0) 

= U(k,6) !y=y> 


(2.9) 


and where use is made of the fact that C(k,0) is a symmetric matrix. 

Using our knowledge that d(k,8) has zero mean value and taking 
expectations on both sides of equation (2.8), 
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E (£(k, 0) = E(£(k,6) + 2Vd(k,0) + V'C(k,0)\>) 

= E(£(k,0)) + 2V-'E(d{k,0) ) + V*C (k,0) V 

= E'(£(k,0) ) + V'C (k,6)V (2.10) 

The linearity property of the expectation operator has been used' here. 

By identification with the result from [12] previously mentioned and (2.1) 
we conclude 

E (£(k,0) ) = n + 6 2 (k r 0)' (2.11) 

If we remember the decision rule which completes the GLR procedure 
from (1.37), we can make some immediate observations. Given the updated 
d(k,0), once y(k) is computed, as in (1.40) for 8 in the range k-M < 8 

/v 

_< k-N as in (1.38) , then 0(k) is chosen to be the 0 which maximizes the 
log-likelihood ratio in (1.36). A failure is declared to have, occurred 

A A 

at time 0 if £(k,0(k)) exceeds a threshold £: 
failure declared 

£{k,0 (k) ) l e (2.12) 

no failure 

By studying the average behavior of £(k,0) as given by (2.11) it 

is possible to develop some ideas on how well the decision rule (2.12) 

responds to failures of different kinds. This, in combination with the 

estimate of the failure in (1.32) , can provide a picture of how the GLR 

system works and of its reliability. This means, that one must study 

2 

in detail the changes in 6 (k,0) . By assuming for the moment that the 
value of the threshold e has been selected in some appropriate manner, 



-47- 


this kind of analysis will m the end provide the knowledge necessary to 
choose e in a way that assures the best detection performance. 

The two quantities that determine* the evolution in time of 

2 

6 (k,0) , V and C(k,0) f illuminate some basic features of the GLR technique. 

2 

The expression for 6 

'<$ 2 (k,0) = V’C (k,0)V (2.13) 

already indicates two important facts. The way the 'failure vector V 
comes into play appeals to our intuition that somehow larger failures should 
be easier to detect. This quadratic dependence of 6 on the actual 
failure is modulated by the generally time-varying matrix C(k,0). It is 
this quantity, the information matrix, which brings to light how the 
GLR approach uses information about the dynamic effect of failure on 
the system residuals . Here lies the essence of the flexibility that 
the GLR approach can bring to the failure detection problem: full use 
is made of the characteristic response of the physical system and Kalman 
filter to each failure mode . 

The matrix (k,0) , given by equation (2.4), measures the in- 
formation available in the residuals at time k from a failure of type 
i occurring at time 0. It is therefore worthwhile to study how it 
changes' for varying k and 0 for the different failure modes. Such a 
study will show how much impact each failure mode has on the GLR de- 
tectors and, consequently, the degree of detectability of various 
failures. In fact, this quantity can be shown to be an observability 
matrix. For these reasons in the next section we take a closer look 



-48- 


at c(k,e> • 

Complementary to the study of the average performance of the 

2 

GLR by way of the non— centrality parameter 6 , one can define and com- 
pute various probabilities of the event that £(k,0) takes on certain 
values or follows given patterns with k or 6 varying. Three useful 
probabilities defined in [12] by Chow are: correct detection, wrong time 
and false alarm probabilities, given respectively by 

P D = Prob {£(k,0) > e|v, 0=9 } (2.14) 

P Q/ = P^, = Prob {£(k,0)|v, 0^0 t } (2.15) 

9 t 

P^ = Prob {£(k,9) > e!v=0} (2.16) 

The correct detection probability P^ measures how sensitive the detectors 
are by giving the probability at time k of detecting a failure v which 
started at time 0^. The wrong-time probability gives some idea of the 
detectability of a failure by indicating the accuracy of GLR in esti- 
mating the time of failure and the persistence of the failure effects 
for 0 > 0^. Finally, P^ gives the probability that a failure will be de- 
clared when no failure is present. It shows the sensitivity of the GLR 
detectors to the noises in the system. 

Although the fact that for the full GLR the £. (k,6) are chi- 

X 

squared random variables makes analysis difficult, one can compute the 
values of these probabilities for cases of interest (see the appendix 
in [12]). Figure 2.1 gives an example of how useful such computations 
can be. It is a plot of P^ for different values of the threshold and of 
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2 

the non-centrality parameter for a x random variable with two degrees 

of freedom. This is the case for our example, which consists of two 

states and two observations. Notice that the curve corresponding to 
2 

6 = 0 is that of P , which is fixed once the threshold is specified. 

The correct detection probability, however, is an increasing function of 

2 2 
6 as shown. For a given threshold, it is the value of 6 that determines 

the probability of detection. 

Figure 2.1 points out one of the basic tradeoffs in the GLR 

technique. By selecting £ large enough the false alarm rate can be reduced 

significantly, an appealing feature for failure detection. In doing so, 

however, is also reduced for any value of 5 as the curves show. Thus 

one is only able to detect failures for larger magnitudes of V. This 

2 

is true at a particular time step, since over a time interval 6 (k,0) 
may grow; enough to exceed the threshold. Two important concepts in inter- 
play can be observed here. In eliminating false alarms via a higher 
threshold, the same degree of detectability is achieved for larger failures 
only. On the other hand, the dynamic character of $ (k , Q) for a given 
failure mode may be such that the value of -£.{k,0) required for detection 
is reached rapidly. This points out how studying C(k,6) in (2.13) is 
valuable for understanding GLR failure detection and also, in particular, 
for selecting the optimal value of the threshold. 

We have ‘only mentioned' some of the possible performance measures 
which are useful to evaluate and understand a GLR detection system. 

Different indices can be used to study other aspects of detector performance , 
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such as correlations of the £. (k,0) in time for various i, k and 0, 

r 

for example. We will introduce some of these as we touch on the areas 
where they are most relevant. The next section examines some important 
elements of the GLR technique in more detail. 

2.2.2 The Signature and Information Matrices 

The last section, focused on the characteristics of £^(k,0) and 

on the way these change under different failure situations. It was seen 

that this random variable can be studied by examining how the non- 

2 

centrality parameter <5 (k,0) responds to different failures. Thus one 
can develop some qualitative understanding of the dynamics of GLR-based 
failure detection and the detectability of the various failure modes . 
Also of practical interest is the development of some criteria for 
selecting those detector parameters , such as the threshold and the di- 
mension of the sliding time window, which greatly affect the performance 
With these concerns in mind, we will concentrate on the information mat- 
rix, C^k,©). 

We have already commented on why this quantity is of importance 
2 

in relation to 6 (k,0) and-, consequently, to the statistical behavior of 
the log-likelihood ratio. In this section we will take a close look at 
the values of this matrix for different i, k and 0. We will proceed 
by first looking at G^k,©), the failure signature matrix, which is cen- 
tral to a study of Ch'(k,0), as (2.4) makes evident. 
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The Failure Signature Matrix, G^(k,0) 

The basis for the GLR approach to failure detection lies, as 
seen in Chapter 1, in the changes that faxlures induce in. the residuals 
of the filter in the system. These changes are specific to each failure 
mode and, for the cases being considered here, they can be expressed 
as the alternative hypotheses. 

H ± : y(k) = TOO + 6 i (k r 0)V i = {1,2, 3,4} (2.17) 

where V is the failure vector and G Q (k,9) = 0 for all k and 0, Hence, 
the time histories of these signature matrices are very informative with 
respect to the degree of detectability of each failure mode. For a 
given failure V we can anticipate the capability of the GLR to accurately 
detect -and estimate it if we understand how the G^(k,0) behave. Ex- 
pressions for the signature matrices for the four failure modes are in- 
cluded in' Appendix A. 'These show the dependence of G^(k,0) on the system 
and filter parameters. 

We have computed the G^ matrices for failure modes i = {l,2,3,4} 
for the reduced F-8C model. They are plotted in Figures 2. 2-2. 5 as a 
function of r=k-0 for the steady-state filter case. Before discussing 

these curves, let us concentrate briefly on the elements of these matrices. 

/ 

Consider Ay , the deviation in the residual due to a failure V, 
from the expression (2.17) 

Ay(k) =y(k)-Y(k) « G jL (k,6)v 


(2,18) 
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or, in more detail. 


AY 1 (kf 


CD 

H 

H 

5 12 <k_91_ 


" V l" 

AY 2 (k) 


Ai tk - 0) 

^22 <k - 9 l 


_v 


(2.19) 


til 

The i row of G(k-0), g and g^ 2 , 9 lves the effect of the failure on 

the i^k component of the residuals. Alternatively, the 3 th column of 

the signature matrix, g and g , gives the effect of the jth failure 

•KJ ^3 

component, , on the different elements of the vector of residuals. 

For the two-dimensional F- 8 C model with failures taken in 
orthogonal directions, we get the following. For pitch rate failures 


of the form v = [v 0 ] ' , 


AY 1 (k) = g 11 (k- 0 )V ( 2 . 20 ) 

Ay 2 ( k) = g 21 (k-0)V 1 (2.21) 

while for angle-of-attack failures, V = [0 V 2 1 ' / 


Ay l (k) = g 12 (k- 0 )V 2 ( 2 . 22 ) 

AY 2 (k) = g 22 (k-0) \> 2 (2.23) 

Comparing the g. . (k-0) for different failure modes provides in- 
ig 

formation about the distinguishability of failures of different modes. 
This is a very important consideration and will be discussed in more 


detail in Chapter' 3 



-54- 


Figure 2.2 and 2.3 are plots of the signatures for the aircraft 
example, where the failure modes correspond to state jump and sensor 
jump respectively. Notice, first of all, that the elements of both 
matrices die out as r, the elapsed time from the occurrence of a failure, 
increases. This is not surprising since both the system and the filter 
are stable. So, for the jump failures, the signatures reflect the im- 
pulse reponse of the system and filter. A sensor failure enters the 
filter directly while a state failure does so only in proportion to its 
effect on the output of the system. The figures indicate that the sensor 
jump signatures tend to zero much faster than those of a state jimp 
failure. This is in agreement with the fact that the time constants of 
the filter are smaller than those of the system for the reduced air- 
craft model. 

The signatures for the cases of state step and sensor step 
failures present a different picture however. Figures 2.4 and 2.5 con-? 
tain plots of their respective elements (for a longer interval in r) . 

Some of these curves now grow with r, rather than dying out. This is 
a reflection of the different nature of these failure modes , The sus- 
tained effect of a step failure on the residuals is in marked contrast 
to the case with jimp failures. Given that the residuals are the inputs 
to the detectors, this implies that step failures are more detectable 
than jump failures. Recall that in the GLR detectors, weighted sums 
of the residuals are sequentially computed over the interval determined by 




Fig. 2.2 State Jump G(r) 
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Pig. 2.3 Sensor Jump G(r) 




-5 



Fig. 2.4 State Step G(r) 
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Pig, 2.5 Sensor Step G(r) 
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the moving window parameters M and N, as in equation (2.3). The per- 
sistent, if hot increasing, deviations in the residuals apparent in 
Figures 2.4 and 2.5 suggest that higher values of axe achieved 

and that, in fact, these likelihood ratios grow in time. Consequently, 
better detection should follow, for "'a fixed threshold, than for the case 
of jump failures. By the same token, it is reasonable to expect that 
the estimation of V will be better for step failures than for jump failures . 

It rs important to realize what the shapes of the different 
signatures tell us about the system and the failures. Recall that the 
signatures indicate how the Kalman filter yields dynamically-related 
estimation errors when a failure is present. These properties of G^(k,0) 
translate directly, as will be emphasized, into the properties of the 
detection performance of the GLR. 

Consider again the plots of G_^(k,0) , Notice how for 'the state 
failures {Figures 2,2 and 2.4) the dominant values correspond to g 22 
and g 2 i , in order of importance. As equations (2.20)— (2.23) indicate, 
these g's give the components of the prediction error in 06 due to failures 
in a (g 22 ) and q (g 21 ) . It is interesting that the main error caused 
by the q failures is in the estimate of a {as g 2 ^ > 9-^) • ’ This reflects 
the way in which the effect of the failure propagates through the system 
and the filter. What the relative magnitudes of the curves for g 22 and 
g 2 i imply is that state failures in a are more detectable than similar 
failures in q. Or, the same degree of detectability is achieved only 
for relatively larger failures in q than in a. In the case of sensor 
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failures (Figures 2.3 and 2.5) , on the other hand, the converse is true: 
failures in <5 are more detectable than those in a. (Notice that, in 
general, g g , i * 1,2). Here again, the off-diagonal elements of 
the signatures (g 2 ^) P^- a y 311 important role for failures in q. For 
these failures the increase in q (the pitch rate) slowly integrates into 
a (angle of attack) in the filter. Thus, the estimate of a becomes in- 
correct to the extent that it leads to the dominant error. So the failure 
in q actually manifests itself mostly in the inconsistency between the 
true and predicted values of a. The GLR technique exploits these dyna- 
mic characteristics which are a consequence of the properties of the 
Kalman filter. 

The failure signatures also provide information concerning the 
capability of the GLR to correctly identify and estimate 6^ , the true 
failure time. The plots suggest that jump failures might lead to better 

/v 

estimates 0 than step failures. This is due to the largely localized 
effect on the residuals at the initial times. For step failures, which 
may become more detectable with time, the initial values of the signa- 
tures are not the largest in general. 

That is, the fact that the effects of some step failures per- 
sist in the residuals is clearly seen by a signature that persists. 
However, by its very nature, a persistent signature has an autocorrelation 
function that is not particularly peaked. Thus, for such failures .we 
expect good detection performance but anticipate inaccuracies in our 
estimate of 0^.. To see this point, the reader may want to compute the 
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autocorrelation functions of g .. in Figure 2.3 and g in Figure 2.5. ' 

• £ JL ZJ. 

This clearly indicates the increased detectability of step failures (as 
indicated by the magnitude of the autocorrelation), and the increased 
problem m resolving. the failure time 6 (as indicated by the peakedness 
of the autocorrelation) . 

Finally, the signatures tell us about the relative distinguish- 
ability of the failure modes. If two different failure inodes have simi- 
lar signatures, potential difficulties arise in discriminating between 

A 

them. In full GLR the estimate V is free to take any value in failure 
space (e.g., a combined a and q sensor failure). Hence, the incorrect 

A 

detector can select V as that V which would best account for the ob- 

/\ 

tained likelihood ratios although this V might not be physically mean- 
ingful. This suggests that other GLR formulations (such as CGLR or 
SGLR, Chapter 1) might have less of a problem in choosing the correct 
failure mode for these cases. Since the failure estimate is constrained 


in direction and/or magnitude, different values of the likelihood ratios 
should result. Looking at the- signatures, for example, one can anti- 
cipate possible difficulty in telling apart a sensor step in q from 
a state step failure in either q or a. The signature curves for these - 

A 

cases can look somewhat alike with proper scaling (which is done by V) . 
Also, there is a potential problem in distinguishing, between a q state 
jump and an a sensor step. Notice the qualitative similarity between 


9 22' g l2 ±n Figure 2 - 5 311(1 9-^' 


in Figure 2.2 (with the proper scaling). 
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This distmguishability problem clearly involves - cross-correlations of 
the various signatures. We will discuss this topic further in Chapter 
3. 


The Information Matrix, C^(k,8) 

One way to interpret the statement that (k, 0) measures the 
information in the residuals at time k from a failure of type i at time 
0 is to view it geometrically. C^(k,0) has the form of an .inner pro- 
duct or projection operator. For example, the non-centrality parameter 
can be expressed, using (2.4), 


<5j(k ,6) = V , C ± (k,0)V 
k 

= V* y%; (j,0)y~ 1 (j)G. (j,0)v 
j=0 
k 

- ^ V,G i' (j^)V~ 1 {j)G i (D,0)V 

j=e 

= <G f («, 0)V, G ,(-,0)V> -1 

X -i V V * ) 

= II V’ 6)' i I| 2 


(2.24) 


where the symbol (*) represents the time index which runs from j=0 to 
j=k. In this case the projection of the failure signature onto itself 
gives a squared-norm measure of the deviation Ay in the residuals over 
the time interval from 0 to k. It is reasonable then that a failure 
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mode* resulting* in a lasting presence in the residuals process , such as 
one of the step failures , will lead to large values of the non-centrality 
parameter. This corresponds to a high degree of detectability as the 
probability of correct detection increases rapidly. 

Suppose the failure vector V is in a given direction, V=IV^ 0] * . 
Then 5^Ck,0) is just a particular element of the information matrix 
with a scaling factor 


S (k,0) = IV, 0] 


' C ll (k ' 9) C 12 (k,0) " 


c 21 (k,0) c 22 (k,0) 


V 


= v£ u (k,e) 


(2.25) 


Similarly for the other direction in the two-dimensional case. This 
means that the elements of C^Ck^) give the directional sensitivity of 
a detector for failure mode i to different failures V. The off-diagonal . 
terms measure the effect on detectability of non-orthogonality in the 
failure directions. The study of the changing values of the information 
matrix is then an additional way of learning about the failure modes 
and the capability of the GLR method for detecting them. 

If the signatures for the jump failures tend to zero as the 
elapsed time increases, then the information matrix reaches a steady- 
state at a fast rate. This is due to the quadratic form of C^(k,8) 
and to the fact that additional terms contribute less as r increases . 

The contrary is true in the case of step failures, where the signatures 
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either grow or remain at non-zero values. Here the information matrix 
does not necessarily reach a steady-state, as more information is ac- 
cumulated with every term in (2.4). 

Figures 2.6 - 2.9 illustrate this. They are plots of the non- 
centrality parameter and correct detection probability versus the elapsed 
time r. They correspond to jump failures (Fig. 2.6, 2.7) of magnitude 
50 and 50’ for the state and sensor detectors and to step failures 
(Fig. 2.8, 2.9) of 10 in the state and 5o' in the sensors. Figures 2.6 
and 2.7 are related to the failure signatures in Figures 2.2 and 2.3. 

We see that in fact 6 reaches steady state almost immediately for the 
sensor jumps while it grows at a diminishing rate for the state jump 
failures . 

Similar comments can be made about the curves in Figures 2.8 and 
2.9 in reference -to the signatures in Figures 2.4 and 2.5. The dif- 
ferences and similarities among these curves are very informative of 
the performance of the GLR detectors. Careful analysis and observation 

r 

reveals how the specific and characteristic dynamics of the system- 

filter combination are reflected in these varying degrees of detectability. 

2 

For example, consider the 5 curve for a sensor step in a, 
... 2 

shown in Figure 2.9. While the <5 curves for the other state and sensor 
step failures show a non-diminishing rate of increase, this one reaches 
steady-state eventually, for the same time interval. The angle of 
attack a is approximately the integral of the pitch rate q. To the extent 
that this is true, a state jump in q is similar to a step increase in the 



5 

r 

2.6 5a State Jump <5 2 and P^ with £=14 (P =0.000912 

D F 






- 69 - 


value of a at the input to the filter. This can be seen qualitatively 

2 

in the fact that the sensor step 6 curve for a in Figure 2.9 is not 

unlike that of a state jump xn q xn Figure 2.6. Analogous comments 

hold for the signature curves g^ 2 ( r ) and '*' n F ^9 ure 2,5 ant ^ tlle 

curves g. ^ (r) and g^ (r) in Figure 2.2, as was mentioned in discussxng 

the signatures. This points out how the similarity in the signatures 

for two different failure modes, as suggested earlier, may lead to 

problems xn distinguishxng failures. The same comment can be made from 

these curves about sensor step failures in q and state step failures 

2 

of both kinds . The simxlarity in the growth of 8 with time is re- 
markable, although not surprising considering the corresponding signa- 
tures . 

For linear time-invariant systems , it makes sense to speak of 
a steady state. The rate of convergence of Ch (k,0) to such a limit is 
a useful xndicator of the length of the window to be chosen, over whxch 

A 

0 xs to be selected in maximizing £^(k,0). For jump failures in the 

sensors it is clear that if they are not detected right away, the odds 

on doing so are not improved by waiting. The non-centrality parameter 

and P D reach their final values almost immediately. In contrast to 

o 

thxs, for step failures 6 is increasing in general with the elapsed 
txme and, therefore, a longer window length would indeed enhance the 
possibility of detection significantly. It must be noted of course, 
that the value of the parameter M thus selected depends also on other 
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cons iderations , The actual size of the failure V must be taken into 
account. For a large enough V detection can be immediate for any 
failure mode and implementing a large sliding window (large M) is waste- 
ful and unneeded computationally. 

All references made in the above discussion to the non-centrality 

parameter 5 (k,9) assume we know 6 to be the time of failure. If so, 

2 

then 6 (k,0) is a measure of the average behavior of £(k,0=8 t ). In fact, 

however, 0^ is considered unknown by the GLR detectors until the decision 
t 

is made by first maximizing £{k,0) over k-M<0<k-N. For each 0 in the 
moving window there is a matched filter d(k,0) which will give the 
likelihood £{k,0) that a failure began at that time. The d(k,k-N), 
d(k,k-N-l), ..., d(k,k-M) "scan" the recent past for possible failures. 

In the maximization operation ,(1.36), the GLR detector in effect 'slides' 
the signature G (k,Q) over the time history of the residuals in the inter- 
val given by the window. Then 0(k) is selected as the 'starting* time 
for which the best correlation is achieved. This correlation is given 

A 

by £(k,0 (k) ) . 

Here we have exposed the dual nature of the dependence of £(k,0) 
on its arguments. For a fixed 0, S(k,0) for increasing k predicts the 
behavior of £(k,0) , as long as that 6 remains in the moving window (the 
window k-M<0<k-N is referenced to k, the 'present' time). So, if 0=0^_ 
then 6 (k,0) gives the growth pattern of the correlation as it evolves 
in time. However, for a fixed k, £(k,0) with 0 varying over the window 
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is a measure of that correlation for different possible 'starting' times 
(in a sense an autocorrelation, assuming a failure has occured) , The 
values of £(k,0) for neighboring 0's reflect the time structure of the 
failure signature. Therefore it will be different for the various failure 
modes. We will have more to say on this in section 2.3.4. 

The non-centrality parameter for £(k,9) when 0 f 0 is given 

0.2 j by 

s 2 (k,eje t ) = vc* (k f 0 |e t )c" 1 (k,e| 0 )c(k,e{ 0 )v . (2.26) 

with 

k 

C(k,0|e t ) = (j,0)V _1 (3)G(j,0 t ) (2.27) 

j=¥ 

and 

0 = max(0,0 t ) (2.28) 

2 

Notice that for 0=0. this reduces, to 5 as in (2.13). The expression 

t 

in (2.26) is in effect an autocorrelation function for the residuals. 

It gives the sensitivity of the detector to the error in the estimate 

of 0^. If 6 2 (k,0|0^) does not vary much for small T=0-0^_ , the GLR 

detector is likely to choose the wrong 0 as often as the correct one. 

We have already suggested that this might be the case for step failures 

in general* But if 6 (k,0|0.) drops sharply in value for small T, the 

t 

^ A 

detector will have ~ little* trouble "in consistently choosing 0=© t , By 

A 

selecting 0 as the 0 for which £(k,0) is largest, this is almost assured. 
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Consider the expression for C(k,8|0 t ) in (2.27). If we let 
r=k-0 and s^k-0^, we can write 

min (r,s) 

C(k,0|0 t ) = G * (£) v'^'G (Z+T ) 

£«=0 

= c (r,s) (2.29) 

for the time-invariant case, with T=s-r. This gives the value of the 
autocorrelation in the signatures for a fixed T. When T=0 we get back 
the original information matrix 

C (k, 0) = C (r,r) (2.30) 

Thus the non- centrality parameter in (2.26) is a normalized autocorrelation 

function for the failure V when viewed as a function of r (i.e., with 

9 as the variable since T=0-0 ) . 

t 

6 2 (k,0|0 t ) '=’ V'C 1 (r,s)C~ 1 (r,r)C(r,s)V 
= 5 2 (r,s) 

= <S 2 (r,r+T) (2.31) 

Going back briefly to the failure signatures with equation (2 .29) 
in mind, we can see how the .wrong- time information matrix reveals the 
time structure of the different failure modes. Clearly the jump failures 
(Figures 2.2 and 2.31 lose correlation rapidly as T, the time shift, 
increases. This is more pronounced for the sensor jump, where the tran- 
sients disappear very quickly. Then <5^ (k , 0 ] 0^) drops sharply in value, 
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for a fixed k, as 0 varies. For the step failures (Figures 2,4 and 2.5) 
this is no longer the case. As T increases C(k,8|8^_) in (2.29) changes 
little because of the larger, if not- increasing, values of the signatures. 

Thus S 2 (k, 0 j does not change drastically for small T=0-0 . Since 

2 ' 

<5 is a function of the failure, these results are modified depending 

on V. For example, the signature for sensor step failures (Figure 2,5) 

indicates that -the autocorrelation for a failure m q is higher than for 

one m a. For a q failure the situation is much like that for the 

state steps while for a it is more like for the state jumps. We will 

discuss this further in the next sections and in Chapter 3. 

One other consideration in deciding on the selection of the 

A 

detector parameters is the desired quality of the failure estimate V. 

In some cases this might not be an issue at all, but if, for example, 

A 

the value of V will be used in compensation adjustments following de- 
tection, the estimation accuracy gains in importance. In 112 ] Chow 

A. 

showed that the error covariance of the estimate V (k) , which has mean 
value V, is given by 

r 

/v A _ 

E([V-VJ [V-V] •) = C _i (k,6) (2,32) 

under the assumption that the full GLR detector has selected the true 

i. 

failure type and time of failure 8. 

In Figures 2,10-2.13 the elements of C 1 (k,8) are plotted for 
r=k-8, based on the simplified F-8C model. One can see that for the jump 
failures, in both the state and the sensors, the best estimation accuracy 
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is achieved in less than five time steps. For step failures however. 
Figures 2.12 and 2.13 indicate that waiting up to twenty time steps can 
result in improved estimation. Again, this all agrees with the notion 
that those failure modes leading to more persistent effects on the 
filter residuals provide more information with time. Since the GLR. 
detectors are computing the correlations between these residuals and their 
hypothesized values for each failure mode, better estimates result from 
having more data available. The signal-to-noise ratios are inherently 
much higher in some failure modes than in others. Notice, for example, 
that for the sensor failures (Figures 2.11 and 2.13) the element C . ^ 
of the covariance matrix is the largest consistently. This means that 
less confidence exists on the estimate of the second component, v^, 
of the failure; the angle-of-attack component. In equation (1,52) in 
Chapter 1 we can see that the measurement of a has a higher noise con- 
tent than that of q,’ This, incidentally, is reflected in the Kalman 
gain matrix in the filter, where the larger gains are in the first 
column (see (1.61)), More weight is given to the information in the q 
residual than to that of a. Going back to the signatures, Figures 2.3 
and 2.5, the sensor failures in q lead to the largest values of the 
%j for b °th jumps and steps. On the other hand, Figures 2.2 and 2.4 
indicate that q state failures have the largest signatures. Figures 
2.10 and 2,12 show to be the smallest values accordingly. 

Before leaving this section, some remarks on the invertibility 
of the information matrix point out some interesting connections to 
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other results. Given the GLR technique, for a failure to be detectable 
it must be able to influence the output of the system. For this reason 
all sensor failures are detectable, although the degree of detectability 
may be small for a particular failure. The noise disturbances in the 
system in fact impose a lower limit on the detectability of some sensor 
failures. The question is really one concerning the observability of 
the system in the absence of failures. Clearly, failures originating 
in an unobservable region of the state space will go undetected by a 
detection system that uses the output measurements, or the residuals 
of the Kalman filter (which is equivalent) , as the information input. 

In [12] it is shown that the information matrix is invertible 
if the system is observable and, in fact, C(k,8) can be interpreted 
as an observability matrix. For sensor failure modes C(k,0) is always 
invertible while for state failure C (r) is invertible if the system is 
observable in r steps or less. If the system is time-varying, the re- 
lation to observability still holds, although with some modifications 
(see Chow [12] ) . The result on invertibility may be used in the se- 
lection of the other window parameter, N. One can choose the value of 
N in the window k-M<0<k-N such that C 1 (N) exists. 

Finally, it must be mentioned that one may study the detectability 
of different failure directions by looking at the behavior of the 
eigenvalues and eigenvectors of C^(k,8). It has already been mentioned 
that the elements of C i (k,0) give the directional sensitivty of the 
GLR detector for the i^h failure mode. The eigenvalues and eigenvectors 
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of this matrix also provide useful information in this area. For a fail- 
ure aligned with one of its eigenvectors, the non-centrality parameter 
of interest is proportional to the corresponding eigenvalue while the 
covariance of the estimate is inversely related to it. For more on this 
see Chow 112] . 

This concludes our comments on the failure signature and infor- 
mation matrices. We have tried to understand some of the structure of 
the GLR technique in order to develop some intuition into the performance 
that one can expect under various failure situations. We will utilize 
this intuition again when we discuss the problem of cross- detection in 
Chapter 3 . 

2.3 SIMULATION RESULTS FOR CORRECT DETECTION 

At this point we are in the position to -study some simulations 
of a GLR system. The results in this section conform to the assumptions 
behind the correct detection formulation under matched conditions, 

2.3.1 Detector Implementation 

The simulations were carried out on an IBM 370 digital computer, 
under the two-dimensional, discrete— time model of the F— 8C aircraft. 

The noise disturbances were taken from a random number generator with 
standard normal distribution [13] . 
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Since numerous simulations were done, a specially designed 
Fortran program, the Multiple Detector Simulation Program (MDSP) , was 
used for these purposes. MDSP simulates linear, time-invariant, discrete- 
time systems with their steady-state Kalman-Bucy filters. Up to four 
GLR detectors can be implemented at a time for failure modes 1-4, in 
any combination and window sizes . Once the system, filter and detectors 
are specified, any of the four kinds of failures can be introduced. The 
output can be selected to display different quantities of interest. 

These include the state, its estimate, the residuals and the output of 
the detectors. The detector performance is available in terms of the 

/s A 

l. (k,0) ’s, the detection decisions and the estimates 0 (k) and V(k). 
l 

Different combinations of this information can be displayed or suppressed 
for any run. A description of MDSP and its user options is contained 
in [ 133 . 

In Figure 2.14 a flowgraph illustrates the implementation and 
,operation of the detection scheme. Once the system data (in the form 
of parameter matrices, noise statistics and filter gains) are read 
in, MDSP proceeds to compute and store the G^{k,0) Ch(k,0), (h ^ (k , 0) 
and V ^ for the length of the windows to be implemented, M-N+l, The 
simulation then begins with specified initial conditions and thresholds 
for the detectors. At the chosen 0^, the failure V from the selected 
failure mode is introduced into the system. Meanwhile, at every time k 
the filter residuals enter the detector algorithms. The matched filters 
are updated and the log- likelihood ratios are computed for each 0 in 




Figure 2.14 Simulation Flowgraph 
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the range of the moving window.' 

d ± (k , 0 ) - d (*-1,0) + G^(k,0)v"‘ 1 (k)YOO (2.33) 

0 e S = {6 jk-M<0<k-N} 

(k, 6) = d|(k,6)C~ 1 (k,0)d i (k f 0) (2.34) 

Detection is declared when 

max -t (k,0) > £ (2.35) 

0es 1 

for each detector, in which case the MLE's of 0 and V are produced 

A 

0 (k) = arg(max 2, (k,0)) (2.36) 

1 0es 1 

A - A A 

V. (k) = cT tk,0(k))d. (k,6(k)) (2.37) 

i i l 

The threshold £ was set to C=5 , a relatively low value, in order 
to study the effect of the noises on detection (i.e., false alarms, 
estimation accuracy, delays, etc.). In addition, this allowed the per- 
formance for higher thresholds to be inferred from the data since all 
the necessary information (the -£* s ) was available. The moving window 
for 0 was chosen as follows: 

Jump Detectors (i=l,3) 

M = 10, N=0 (2.38) 

Step Detectors (i=2,4) 


M = 30, 


N=0 


(2.39) 
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The value of N is justified since this is an observable system. The 
parameter M was chosen with the discussion in 2.2.2 taken into considera- 
tion. That is, for jump failures a longer window m the detectors would 
provide ho further information. Figures 2.2— 2.3, 2. 6-2. 7 and 2.10-2.11 
indicate that the short-lived effects of these failures are detectable 
immediately following their occurrence or not at all. On the other 
hand, a look at Figures 2. 4-2. 5, 2. 8-2. 9 and 2.12-2.13 shows how the pro- 
longed presence of the step failures leads to improved detection. The 
detectability and accuracy in the estimates for these failures benefits 
with the passage of time. The value of M selected represents a com- 
promise between these factors and the computational and storage require- 
ments . 

The failures were simulated one at a time for the. range of magni- 
tudes and directions shown in Table 1.1. The motivation and interpretation 
of the failure events modeled by these vectors were discussed in Chapter 
1. Consideration of these failures in the different state variables and 
sensors enables us to appreciate the way the system dynamics and detector 
response are related. For each failure simulated in this section two 
different realizations of the noise sequences were considered. While 
this does not statistically va'lidate the results, it does provide insight 
into GLR performance. 

2.3.2 False Alarms ; Detector Sensitivity 

We begin the evaluation of the simulation results by looking 
at false alarms. This is an important issue in the design of the GLR 
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detectors since detection cannot be reliable if they are overly sensitive 
to new data. 'Detection' in the absence of failures is no better than 
neglecting to detect one when it is present, A study of the resulting 
false alarm rates for a given implementation of the GLR detectors is 
therefore crucial. Dealing with this problem involves one of the main 
tradeoffs m the design of a failure detection system. Its resolution 
lies in the selection of the threshold. A large value of the threshold 
can eliminate most or all false alarms, but at the expense of other 
factors in the quality of detection. 

Figure 2.15 shows a plot of 

l* (k,0) = max l. Ck,6) ' C2.40) 

0 i 

f 

for the state jump and state step (i=l,3) detectors for a run with no 
failure. At a time k, £*(k,0) is the largest log-likelihood ratio for 
all the 0 ' s included in the windows The data corresponding to the state 
jump detector stops at k-20. Two facts are noteworthy here: 

. a relatively small change in the threshold can reduce 
the number of false alarms very effectively 

. the jump detector is more sensitive to the noise on 
the average, than the step detector 

The first point is encouraging since most failures of interest 

are likely to still be detectable after a small change in the threshold. 

Large values of the non-centrality parameter are not uncommon (see the 
2 

6 plots in section 2,2.2), thus assuring a good probability of detection. 



j'(hB) 
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With. respect to the second remark, jump failures can be thought of as 
noi.se spikes or outliers outside their statistical distributions* Con- 
sequently, the jump detectors can be "fooled" by a noise sequence with 
large spikes. By the same token, step failures involve persistent effects 
and thus are less susceptible to short bursts of t noise. 

In Table 2.1 we compare some results from false alarm (V=0) 
simulations with previously computed values of the false alarm pro- 
babilities for different thresholds* Recall the definition of P^: 


= Prob {£(k,6) > e|h } 
F 1 0 



p(£(k,0) |h^) d£ 


(2*41) 


The numbers off erred for comparisons are ratios of times when £(k,0) 
exceeded the threshold to the total number of time steps, NTS, for 
each particular run. NTS equals 20 for the jump detectors and 40 for the 
step detectors. By ND we represent the number of times that detection 
was declared, ije*, times k for which £*(k, 0) > £. NDD however, is a 
more meaningful measure of false alarm rates than ND. It is the total 
number of distinct detections: detections declared as different events. 

This was determined by the estimate 0 of the "failure" times (different 

A 

0’s corresponding to distinct detection). So, for example, three detec- 

f 

tion decisions in a row at times k-1, k-1, k declaring a failure as having 

A 

occurred at some 0^ is counted as 1 for NDD but as 3 for ND. While ND/NTS 
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says something about the accumulated effect of the noises on the sensi- 
tivity of the detectors, NDD/NTS in a sense sifts out the effect of 
particularly large noise values once they result in a detection decision. 

Although admittedly primitive, these .counts qualitatively confirm 
the anticipated relationship to the value of the threshold. One would 
need a much larger data set over which to obtain a truer image of the 
noise handling capabilities of the GLR detectors. As previously sug- 
gested, state jump and step detectors show a tendency to be less affected 
by the noise than the sensor detectors. The reason is that the system 
acts as a low-pass filter on the plant noise . In' this sense then the 
measurement noise is potentially the bigger problem for detection, A 
different kind of failure detection criterion - one which checks for 
persistence in the £(k,9)*s - would show greatly reduced false alarm 
rates. One s'uch test might, for example, count 'only when £(k,6) re- 
mains above the threshold or grows in time. This would take advantage 
of the patterns in the likelihood ratios, as a function of k and 0. 

We will talk about this further in section 2.3.4. 

2.3,3 Failure Detection 

We have seen the response of the GLR detectors in the absence 
of failures. The next question is, how well can the GLR system spot 
and track a failure once it has taken place? With good performance 
we associate fast detection following a failure and reasonable accuracy 
in the estimates for the time of failure and of the failure itself. The 


r 
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identification of the correct failure mode is not an issue here, but it 
is the topic in Chapter 3. Complementing the discussion on the detect- 
ability of different failures, we now look at the simulations with failures. 
One must keep in mind that the failure size is measured here in propor- 
tion to the intensity of the corresponding noise disturbance that affects 
the system in the same way that the failure does. 

One good piace at which to begin an evaluation of the detection 
performance of the GLR in the simulations is with the delay times. If 
a failure occurs at time 0^ , then the delay time, T=k-0^ , until the de- 
tector declares a condition of failure is a good indication of the sen- 
sitivity of the detection system. If the delays are too long the detec- 
tion system may be useless. This presents the other side to the trade- 
off in the selection of the threshold. For a given application one must 
reach a decision which is a compromise between tolerable false alarm 
rates and delay times in detection. No general rules can be put forth 
since the criteria change with the system and the failures that are con- 
sidered important. 

We have computed the delay times in the detection of the failures 
simulated. Table 2.2 includes the detection delays for all. the state 
and sensor jump failures simulated for the threshold set to the values 
5, 7, 10 and 14. They are grouped by failure mode and by the direction 
of the failure vector : pitch rate and angle-of-attack (and their measure- 
ments) . The columns in Table 2.2 show the delays for all the failures 
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Table 2.2 Delays in Detection for Different Thresholds: 
Jump Failures. Measured in time steps from 0^. 
(One time 'Step = 1/32 of a second) . 
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down the effect shown by 'the ‘ signatures / * Since the failure 'magnitudes 
have been referenced to the noises , the relative values of the signatures 
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for q and a failures must be seen in light of the relative values of the 
the failures in q and a also,, This, for example, accounts for the 
marked difference in the values of 6^ for q and a sensor jumps 
in Figure 2.7. The corresponding signature in Figure 2.3 shows somewhat 
larger values for q failures (g ) than for a (g ) . The noise intensity 
in a, however, is distinctively larger than that in the q sensor, as 
Table 1.2 points out. 

This is perhaps easier to see by looking at the growth of ^(kfB) 
(see (2.40)) after a failure takes place. Figure 2.16 is a logarithmic 
plot of -£*(k,6) for state and sensor jumps of 50 and 50', respectively, 
in both q and a. Here we can observe that 

. State jumps give rise to higher values in the GLR than 
sensor jumps . This is in agreement with the more pro- 
longed effect on the residuals. The- signatures, we have 
seen, clearly illustrate this (see Figures 2.2 and' 2.3). 

. While £*(k,8) grows with time for the state jump failures, 
the maximum values for the sensor jumps is reached almost 
immediately. Notice the similarity to the growth in 6^ 
shown in Figures 2.6 and 2.7. 

. The failure; in the q sensor suffers more severely than 
one in a in loss of detectability for an increase in 
the threshold. We have just discussed this (see Figure 
2.7) . 

. £*(k,0) drops in value much more sharply for the sensor 

failures once £he time of failure 0 is no longer a 
candidate for 0 in the window. 


The last observation points out again how the kind of correlation pre- 
sent in the residuals from time to time, which differs for the various 
failure modes, plays an important role in determining the detector 
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Fig. 2.16 Evolution of £|(k,0) for Jump Failures, Average over Two Runs 


-95- 


response. For the sensor jump failures the signature (Fig. 2.3) shows 
a quick transient, well localized in time. This implies that the in- 
formation in the residuals for two overlapping time intervals becomes 
uncorrelated for very small shifts in region of overlap. This is not 
the case for state jumps where the failure xs integrated into the state 
of the system and its effects last longer. These kind of structural 
dxfferences in the impact of different failure modes can and should be 
exploited in seeking the most reliable detection system. 

Figure 2.17 is a similar plot of £* (k,0) for state and sensor 
step failures . Notice that the data for the state step failures is for 
a magnitude of .5(X in q and a while for the sensor steps it is of 5CT* 
in the measurements of q and a. The state step failures, in general, have 
a much stronger impact on the residuals, and consequently on the GLR, 
than comparable sensor failures. The reasons are the same, discussed in 
connection to the. jump failures. The steps in the state are integrated 
into ramp-like behavior in the output of the system (see the signatures 
in Figures 2.4 and 2.5). 

It is worth comparing the curve for £*(k,9) corresponding to 

a sensor step in a with that for the non-centrality parameter for the 

2 

same failure in Figure 2.9. This corroborates our analysis of 6 as 
a measure of the dynamic behavior of the log-likelihood ratio and the 
performance of the GLR system. One might also .note the difference in 
the growth rates and actual values of t* { k,0) between jump {£*, £*) and 

1. X ^ 

step (-£*, •£*) failures. The sustained presence of step failures results 
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Fig. 2.17 Evolution of £*{k,6) for Step Failures, Average over Two Runs 
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in an order of magnitudes difference in these values. 

Figures 2.16 and 2,17 verify our analysis of the wrong-time non- 
centrality parameter in Section 2.2.2. Consider the behavior of £*(k,0) 
when 0 drops from the moving window (k=15 for jumps and k=35 for steps). 
After this time, 0 is chosen as the most likely of the remaining 0's. 

In general the next 0 chosen is 0^+1 , 0^+2 , etc. So we are looking at 
the £*'s corresponding to- 6 (r, r+T), where both r and T are increasing. 

The fact that r is also increasing in addition to 1=0-0^ accounts for 
the continuing increase in £.* for some of the curves in Figure 2,17. 

For step failures 6 (k , 0 J 0 fc ) increases with k for all the 0's in the 
window (although, for a fixed k, 6 decreases with T) . As discussed earlier, 
the sensor jumps lose correlation in the £*s rapidly for the wrong 0's. 

The same is true for state jumps, although it is less pronounced. Finally, 
notice how the Z's for an a sensor step indicate wrong-time correlations 
not unlike the state jumps. This is further evidence of the way in which 
the differences among the failure modes seen in the signatures translate 
into distinctive, patterns in the likelihood ratios . We will see this 
in more detail in the following section. 

Finally, Figure 2.17 tells us that we can expect for step failures 

. shorter delays in detection in general 

. less sensitivity of detection to changes in the 
threshold 

In Table 2.3 the delays in detection are presented for two sample runs, 
for state and sensor step failures. Notice that data is included now for 
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27 ,°° 

1/20 

EG 

5,0 

6,0 


1/20' 

0,0 

0,0 

15,0 

27, « 

10 

1,0 

2,0 


3,2 

10' ‘ 

0,0' 

0,0 

15,0 

27,2 

50 

0,0 

0,0 

0,0 

0,0 

50' 

0,0 

0,0 

0,0 

6,0 

100 

- 

- 

- 

- 

100' 

0,0 

0,0 

0,0 

0,0 

200 

- 

- 

- 

- 

200' 

0,0 

0,0 

0,6 

0,0 


Table 2.3 Delays is Detection for Different Thresholds: 

Step failures. Measured m time steps from 9^. 








-99- 


f allures of magnitudes .507 . Iff and ,5a 1 , ,1a'. The two points mentioned 
above are clearly indicated by the (limited) data for step failures of 
Iff (or Iff') and larger, m comparison to the jump failures. Even for 1 
the case of most small failures here, detection is fast for high thresholds. 
Although somewhat sensitive to increases in £, the growing nature of 
6 for these failures means that for a larger window detection is assured 
after some time. In order to provide some additional insight into these 

i 

results, we point out that with a threshold set at £=7 the longest delay 
in the simulations for .Iff and .Iff* step failures was 14 time steps (about 
.44 seconds) . This was the case for a .Iff state step in a, which trans- 
lates into a magnitude of 4.3335x10 radians, or approximately 2.4831x10 
degrees. The same failure with £=14 doubles its delay time, still under one 
second, and eliminates almost all false alarms, as seen before. Thus we see 

that the GLR performance under. perfectly matched conditions can be extremely 
good. The limitations come in, of course, as we consider some of the 

more realistic constraints — i.e., when the type of failure is unknown 
or when the system model is in error. These issues will be addressed 
in Chapters 3 and 4. 

2,3.4 The Failure Estimates: V and 6 

The simulation results seen so far tentatively corroborate our 
prior qualitative analysis of the GLR performance. Another component 
of the performance of a failure detection system is the estimation of 
the failure event. For a technique such as the GLR which takes into 
account the dynamic propagation of the failure through the system, the 



— 100 ' 


estimates of the failure and of its time of occurrence are good indicators 
of the quality of the detection. These estimates can provide crucial in- 
formation, as we will see, in the event that complications arise in de- 
tection. Specifically, they will be useful in providing information that 
will allow us to determine the failure type (Chapter 3} , or to identify 
the presence of significant modeling errors (Chapter 4) . For the moment, 
let us take a look at the performance of the GLR detector's under matched 
conditions and correct detection of failure modes, by way of these esti- 
mates . 

From (2.37) the estimate of the failure at time k is given by 

V(k) = C _1 (k,8(k))d(k,9(k)) (2.42) 


once 0 (k) has been selected. Assuming that 0 is the corr ect e stimate, 

A i A A 

E (V (k) ) = C (k,6) E (d (k,6) ) 


-1 


= C (k,0) E (d (k,0) + C(k,0)v) 


A ~ A A A 

= C _ (k,0) E (d(k,0) ) + C (k,0)C(k,0)V 


= 0 + XV 


= V 


(2.43) 


So V is an unbiased estimate of the true failure if 0 is accurate. Notice that 

A 

V(k) in (2.42) is the unique solution of 
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A A 

C (k,0) V - d(k,0) 


(2.44) 


where V is considered unknown. The GLR detectors actually solve for the 

failure which best fits the mean value of the matched filter for the 
o 

selected time 0. 

A 

If the estimated failure time is incorrect, 9^0^ , then 

A _ A ^ A 

E(V(k>) = C (k,0) E(d(k,0) + C (k, 0jv) 

t 

-1 ** 

= C (k,0)C(k,0 t )V (2.45) 

A A 

The bias in V introduced by the error in 0 can be examined for different 

A 

9-0 in much the same way as the wrong-time non-centrality parameter 

5(k, eje t ).‘ 

With these ideas in mind we now look at what the simulations 

A 

show about the GLR estimates. First we consider the estimate 0 of the 

« 

time of failure. The general trends in the simulations of the GLR de- 
tectors for the four failure modes are discussed, first for the state 
jump and state step failures. 

State Failures 


. for state A jump failures of size Iff and higher, the 
estimate 6 is accurate in general. 

A 

. for state step failures larger than ,5ff, 0~0 almost 
immediately; for \K.5ff, ‘0 undergoes an initial transi- 
ent but soon coverges to 0 (+ 1 or 2 time steps). 

. once 0 is no longer in the range for 0 m the window, 
GLR chooses the point farthest in the past that is in 
the window. 
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2 

Looking at the growth of 6 (k,0) for these failure modes in 
Figures 2.6 and 2.8, the initial rate of growth for the step cases is not 
very large. So for small failures it is possible for the noises to 

A 

incorrectly influence 0 until enough time has passed and larger values 
in 6 are achieved. For the state jumps the situation is different 
and there is, in general, good estimation of 8 (but for larger size 
failures). Figures 2.18 and 2.19 illustrate this. They are three- 
dimensional plots of £(k,0) as a function of its two time arguments. For 
these the detector windows were set at M=50, N=0; the total length of 
the run is 60 time steps and 0^_ = 5. For each time k, the values in the 
(£.,0) plane are the £(k,*) for k-5O<0<k. Alternatively, for a fixed 0 
the projection on the (£,k) plane gives the growth in time of £(*,9), 
k=0,l,..., 60. The values along the diagonal k=0 correspond to £(k,k) 
and moving parallel to the 0 axis toward 0=0 shows the output of the 
detectors at a time k for the whole window. Figure 2.18 is the output 
of the state jump detector for 5(7 jumps in q and a. The output of the 
state step detector is shown in Figure 2,19 for la failures in both state 
variables also. 

Consider first the state jump failures in Figures 2.18. We see 

that after the failures take place at k=5 the £(k,0) quickly grow r reaching 

the final values after about 20 time steps (5/8 sec,). Notice how well 

the failure time is isolated, with £(k,0|0 ) for 0/0^ having much smaller 

t t 

values than £(k,0 t ). As k increases £*(k,0 t ) recedes from the diagonal 
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Pig. 2.18(a) Likelihood Ratios: 5a q State Jump 
Failure; State Jump Detector 




Fig. 2.18(b) Likelihood Ratios: 5a a State Jump 
Failure; State Jump Detector 
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£(k,0) 


l : 5,145 
max 



Pig. 2.19(a) Likelihood Ratios: 10 q State Step 
Failure; State Step Detector 


£(k,6) 


l : 


max 


5,615 



Fig. 2.19(b) 


Likelihood Ratios : lO a State Step 
Failure; State Step Detector 
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A 

as the correct estimate 0=0^_ is maintained. Notice what happens after 
time k=55. The true failure time 0 is no longer in the window so 0^_-hl , 

A 

0^+2, etc. are chosen as the values of 0. The GLR. detector chooses the 
earliest time in the window as the most likely starting time for the 
effects of the failure on the residuals. It is clear in Figure 2.18 
that, for the jump failures, after some time the £(k,8) for the remainding 
0's in the window will be smaller. Eventually the detector will not see 
the failure at all any longer. As the signatures show, the effect of a 
jump failure in the state diminishes with time. 

The situation for the state step failures is different in many 
ways, as Figure 2.19 indicates. Here the growth of the log-likelihood 
ratios is slower initially, but much larger values' are reached and no 
steady-state is seen. The distribution of £(k,.) over the window shows 
a very different response. While the wrong-time £(k,0j0^_) grow in the 
same way as £(k,0 t ) , for a given interval in 0 the drop in the £' s is 
not as dramatic as in the state jump detector. Although the same be- 

A 

havior is observed for 0 once 0 leaves the window at time k=55 (hidden 
by the angle in which the plots are done) , the increasing values of 
£(k,0|0 t ) with k mean that detection can occur long after, for k»0 t <. 

This illustrates the central difference between the two failure modes . 

The continued presence of a step failure leads to a very different re- 
sponse pattern of the £(k,9), As a function of k, the composition of 
£<k,0) tells us about the detectability of the failures as time progresses. 
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As a function of 0 the same response shows the kind of correlations in 
time which characterize the temporal evolution of a failure mode in the 
system. That is, the transient nature of the jump leads to highly peaked 
£' s as a function of 6, while the persistence of a step leads to large 
£'s over a range of 0*s. 

Sensor Failures 

The following summarizes general trends in the simulations 
corresponding to sensor jump and step failures: 

. much more sensitivity to the noises in the system than for 
comparable state failures 

. much lower values of £ (k,0) , implying greater sensitivity 
also to changes in the threshold for the detection of 
small failures 

A 

. for sensor jumps 0 is very erratic once 0 leaves the moving 
window (as one might expect for such a transient failure) 

We can discuss these features by referring to Figures 2.20 and 
2.21. They show the corresponding plots of £(k,0) for 50 r sensor jumps 
and la* sensor steps, respectively. Several things stand out immediately. 
First consider Figure 2.20. As a function of k, £(., 0 .) reaches its 
maximum value almost instantly. This is just as suggested by the non- 
centrality parameters in Figure 2.7. The magnitudes of these likelihood 
ratios are relatively low and keep the proportions seen for the 6^, 

with higher values for the 5a’ sensor jump in a. Notice that these plots 

* 

are scaled to the maximum value of £ (k,0) (this must be kept in mind 




- 108 - 


Fig. 2.21(a) 


Fig. 2.21(b) 


■£{k,0) 

Z : 
max 


15 



Likelihood Ratios: 10' q Sensor Step 
Failure; Sensor Step Detector 


Z (k,0) 

Z : 25 
max 



Likelihood Ratxos: 10' a Sensor Step 
Failure; Sensor Step Detector 
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smce, for example, the values of £(k,0) for the jump in q are of the 
order of the noise level in £(k,0) which are therefore scaled up in the 
p3- c, t) . With respect to 0, £(k,8) behaves similarly to the jump in the 
state case , although the change in value for 0 ' s neighboring 0 is more 
pronounced. The ratio £(k,0 )/£(k,0|9 ) can be large even for 0-0 small. 
This reflects the very short duration of the failure effects on the re- 

A 

siduals, as is clear in its signature. Once 0^ leaves the window 0 is 
randomly directed by the noise. 

In Figure 2.21 we have the detector output for la' sensor failures 
in q and a. Again we find that the values of £(k,0) are much smaller 
than those for state step failures. Furthermore, the £(k,0) look very 
different for a q sensor step and one in a. All this was indicated by 
the non-centrality parameters and the signatures in section 2,2.2. Fin- 
ally, the response to a sensor step in a is qualitatively similar to that 
for the state jump in q (see Figure 2.18) as was argued earlier in the 
Chapter. This similarity is even more striking if we consider larger 
sensor failures where the noise effects are small in comparison. Figure 
2.22 makes this more evident. It gives the response to sensor step 
failures of magnitude 10O ' in both q and a. Except for the values reached 
by £(k,0), notice the resemblance of the £'s for a sensor step Jin q to 

’ . <■ i > 

those for state steps in Figure 2.19 and between the £*s for a sensor 
step in a and those for state jumps in Figure 2.18. 

This last fact already anticipates a source of possible trouble. 

If we do not assume, as we have done in this chapter, that the failure 
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|fc(k,ej 


Z : 


max 


2,608 



Fig. 2.22(a) 


Likelihood Ratio: IOC q Sensor Step 
Failure; Sensor Step Detector 




'£(k,0) 

i 




Fig. 2.22(b) 


Likelihood Ratio: 10a' a Sensor Step 
Failure; Sensor Step Detector 
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mode is known, then these plots suggest that other failure modes might 
trigger similar responses in the detectors. It must be pointed out, 
however, that the shapes of correct detector £'s being' the same does not 
necessarily mean that there will be cross-dection problems. These im- 
portant issues are the topic of Chapter 3. 

A 

We now come to the estimates of the actual failures, V. We have 

A A 

seen that if 0 is a correct estimate, V has as mean value V, 

Let us consider first the state jump and step failures. 

State Failures 

The estimation performance of the GLR detectors observed in the 
simulations, for all the state failures tried, show: 

, for jumps, the best estimates are obtained in less than 
5 time steps (~ 1/6 sec,). When leaves the window 
v degrades soon after, 

. for step failures of magnitude .50 or less, the estimates 
are not very accurate and lose quality wjhh time. For 
larger failures there is improvement in V, with the best 
estimate occurring after a wait of about 15 time steps 
(~ 1/2 sec.) . 

It is not surprising that for state jump failures the estimate 

A 

V does not improve much after its initial values. The covariance of the 
estimate error, C \ remains near constant in time (Figure 2,10), The 
initial estimates are as accurate as any others which may follow. When 

A 

0 is outside the window — so that 0/8, necessarily — the estimate 

U L 

A _ A A 

V(k) = C*~ a(k,0) , 0/0 t 


(2.46) 
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degrades rapidly* The reason is that dCk/0^) and d(k,9) in (2.46) cor- 

A 

relate poorly except for very small | 0-0^1. This is not the case for state 

step failures. As the 3-D plots just seen indicate, for state steps the 

d(k,0) for 9*s after 0 are highly correlated with d(k,0.). This is 

t t 

evidenced by the relatively close values of Z(k,0 ) and £.( k, 0 1 0 ) , as 
long as |S-9 t | .remains moderate. Furthermore, Figure 2.12 shows how much 

A 

the error covariance for v is reduced by a wait of about 15 time steps . 
After 'that there is .little improvement. These results are thus consistent 
with our prior analysis. 

Figures 2.23 and 2.. 24 'illustrate these ideas. The first one 
is a plot of the estimates produced by the jump and step detectors for 
lo jump and step state failures in q. The jump detector has window 
parameters M=10, N=0 while the step detector has a window M=30, n=0. 

A* 

^Notice that for the jump 'detector the estimate v after k=15, 'the last 
time that 0^ is in the window, quickly moves in the wrong directions. In 

A 

addition, there is little change in V while 6 remains 'in the window. 

The state step estimate, however, does tend to converge slowly toward 
the actual failure. Convergence is faster initially, coinciding with 
the changing C ^ (k, 0) in Figure 2.12. For very large jump and step 

A 

failures, the V‘s are much better in that we have the same standard de- 
viation for the estimate errors, but these are smaller m relation to 
the larger sizes of the actual failures. 

Sensor Failures 


For the sensor jump and step failures, the simulations allow for 
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‘TRUE FAILURE 


A .-JUMP IN STATE (M = 10, N = 0) 
O' .STEP IN STATE (M=30„N=0) 

X :1c State Failures 
0=5 


Fig. 2.23 Phase Plane Plot of the Estimate: la State Failures 



Fig. 2.24 Phase Plane Plot of the Estimate: 5a State Failures 


-114- 


-115- 


the following observations: 


. the difference in the quality of V between small and large 
failures is more significant than for the state failures 

. sensor jumps of up to 5(7* in size have estimates which are 
very sensitive to the noises 

• for step sensor failures of 50' or larger in magnitude , 
the accuracy achieved can be very good. One can achieve 
improvement in the estimates by waiting: the best esti- 
mates are obtained after more than 10 time steps ( > 1/3 
sec) . 

A 

• rapid degradation in V occurs when 8^_ drops out of the 
window in the jump detector. For the step detector 
the degradation is gradual. 


At this point it should not be unexpected that for small failures 
in the sensors the estimates are very sensitive to the noise disturbances . 
The information matrices do not reach as large values as their counter- 
parts for state failures. Therefore in 

d (k , 0 ) = d(k,8) + c(k,0 )v 

■ t 

k-M<0<_k-N . (2.47) 

A 

the first term, d(k,0), can greatly affect the estimate V in (2.42) for 

A 

the failures which are not very large. Since V is computed to solve 
equation (2.44), the effect of that term is negligible by comparison 
for large V. Another factor involved in this question has to do with 
the dynamic- nature -of the-system response to the failure. Clearly, for 
a sensor step for which C(k,© t )V is increasing, one can expect improved 
estimates after some time. The error covariance for the estimate in 
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Fig. 2.25 Phase Plane Plot of the Estimate: 5C Sensor Failures 
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this case, shown in Figure 2*13, indicates the improved confidence m 

A 

the estimate after a waiting period. In Figure 2.25 a plot of V is given 
for 5a' jump and step failures in the q sensor. Notice how the estimate 
for the step finally converges near V after, a very erratic beginning. 

2.4 SUMMARY OF CORRECT DETECTION 

The GLR technique for failure detection has been examined in 
detail in this Chapter. Under the assumption of perfect knowledge of 
the model parameters and of the failure mode, the performance of the 
GLR detectors is quite good. We have seen that the detectors are very 
sensitive and, therefore, that detection is guaranteed for all meaningful 
failures (a sensor jump, for example, of less than 3cf does not make 
much sense) . 

While this kind of sensitivity might suggest difficulties arising 
from the noise disturbances in the system, we have seen that this is not 
the case. The reason for this is the very concept of hypothesis testing 
inherent in the GLR — i.e, the GLR detectors take full advantage' of the 
structured and dynamic effect of the failures by correlating the observed 
residuals with the failure signatures. 

The differences observed in the performance of the GLR detectors 
for the four failure modes studied here have been linked to the charact- 
eristics of the failure signatures for those modes. A detailed analysis 
of the signatures G(k,0) and of the information matrix C(k,8) associated 
with them has shown that a study of the average behavior of the likelihood 
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A A 

ratios and failure estimates 0 and V is feasible and reasonably accurate 
in predicting the performance of the detectors. The simulations presented 
corroborate the previous analysis based on knowledge of the signatures. 

One of the key quantities in our analysis is the non-centrality 
2 

parameter 6 , which gives the failure-induced component of the expected 
value of the likelihood ratios . This 6 captures all the information 
concerning the failure and its dynamic effect on the filter residuals. 

Its study for different failures in the four modes of interest allows 
us both to predict the detection performance for a given detector con- 
figuration and to systematically select those detector parameters to 
achieve optimum performance. 

By means -of 6 *(k,0) we can look at the patterns in the behavior 
of the likelihood ratios, for different failure modes, as a function of 
k and 0. We saw how, ultimately, all these features can be related back 
to the signatures of each failure mode. For example, we saw that for 
jump failures, especially sensor jumps, <5 grows toward a steady-state 
value (as does the probability of detection) for the correct 0, while 
falling sharply in value for the wrong time 0 in the detector 
window. Figures 2,. 18 and 2.20 in section 2,3.4 illustrate this vividly. 
This reflects the transient nature of the filter response to these 
failures (Figures 2.2 and 2 . 3 ). 

In the case of most step failures $ increases indefinitely with 
k after the failure takes place. Furthermore, the wrong-time S 2 also 
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attain large values with time, especially near 0 . The exception is a 
sensor step failure in a which looks like a state ;jump (Figures 2.2 and 
2.5) , a fact which is clearly indicated by -comparing Figures 2.19* and 2.22 
with Figure 2.18. In contrast to the jump cases, the rest of the signa- 
tures for these step failures grow with the elapsed time thus providing 
more information in the residuals as time passes . Since the residuals 
over any time interval {after 0^_) show increasing values, especially 
near 0 , the GLR detectors for these modes in general have more of a 

, A 

problem with wrong- time estimates 0, although detection for some 0' is 
far easier than in the }ump case. This is also shown by Figures 2.19 
and 2.21(a), 2.22(a). 

All these observations about the failure modes and the likelihood 
ratios point out the role played by the selection of the threshold. As ^ 
mentioned earlier, false alarms can be effectively removed by a raised 
threshold. This, in turn, implies longer delays in the detection of 
failures since the likelihood ratios must reach the new value. The 
analysis and simulations show, however, that for most failures of interest 
the delay is minimal. In general, failures of all four modes are quickly 
detectable if their magnitudes ar.e of the order of the noise intensity 
or greater. The most troublesome failures are sensor jumps, which are 
nevertheless easily detectable for larger failures (e.g., sensor jumps 
of magnitude 5C or greater) . 

While the probabilities used as performance measures, P Q and , 
are valuable indicators of the detection quality of a specific GLR scheme. 
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they are by no means the only important ones or the definitive ones. Other 

probabilities can be defined on events which, relate to the evolution of 

the likelihood ratios over intervals of time,’ rather than for given values 

of k and 0. In this sense P and P„ are static measures which must be 

D F — 

computed for a sequence of times. One can, for example, define the time- 
to-detection probability 

P mn (T,£, 0,0 ,V) = Prob(£(k,0}> £ for some k < T 1 0 ,V) (2.48) 

of the event that detection takes place for a given 0 in T time steps or 
less. This quantity is clearly of importance in determining detection delay 
as a function of the threshold. The only drawback to this kind of analy- 
sis is that correlations between likelihood ratios are involved and for 
full GLR (and CGLR) it becomes difficult. The reason is the chi-squared 
nature of these random variables. Thus, a shift in focus to the simpli- 
fied GLR (SGLR) might be rewarding in trying to obtain this kind of infor- 
mation. For the SGLR, recall, the likelihood ratios become Gaussian 
random variables . The evaluation of interval— related quantities such as 
(2.48) is still involved in this case but is somewhat more tractable. 

Further work in this area is needed. It is felt that such SGLR analysis 
vail also shed light on full GLR and CGLR performance, since the de- 
tectors have performance characteristics that are similar to SGLR (e.g., 
wrong-time and detectability conditions are the same for all three) » 

The tools with which we have examined the performance of the 
GLR detectors have been adequate, nevertheless, for the task of uncovering 
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the basic mechanisms at work. On the one hand we have seen the inter- 
action between failures of different modes and the responses they induce 
in the Kalman filter residuals , On the other, this interplay between 
failure modes and residuals has been related to the relative detectability 
of these modes via the GLR technique. These tools allow, at this stage, 
for a systematic consideration of the different tradeoffs which must be 
taken into account in implementing a reliable detection system. Once the 
threshold has been chosen (a compromise in delays and false alarms) , the 
length of the windows can be arrived at (for example, by computing the 
waiting times necessary for a specified probability of detection: e.g., 

P D = .95 or P D = .99) . 

In the next chapter we relax one of the assumptions held up to 
now. We consider the problem of isolating correctly the mode of a failure, 
if and when detection has taken place. This will provide an opportunity 
to determine some of the limitations of the GLR technique in a more 


realistic environment. 



CHAPTER 3 


IDENTIFIABILITY OP FAILURES WITH THE GLR 

3.1 MATCHED CONDITIONS AND THE CROSS-DETECTION PROBLEM 

This chapter considers an important question concerning failure 
detection which has not been directly addressed yet: the distinguish- 

ability of the various failure modes. The discussion of the performance 
of the GLR technique in Chapter 2 was restricted to the situation where 
the failure mode is known. Consequently, the emphasis was on the capa- 
bility of a GLR detector to correctly identify when a failure in a speci- 
fic mode occurs and to estimate it. We will now consider the case where 
the mode of the failure is not known in advance. Given the decisions 
and output of a set of GLR detectors corresponding to different failure 
modes, the problem is to isolate the correct decision with the highest 
possible degree of certainty. The assumption is made that if a failure 
does take place, its mode is that of one of the detectors. 

This problem may be viewed in a different way. Suppose that a 
GLR detector has been implemented based on the hypothesis of a particular 
failure mode. While in operation, detection is declared for a number 
of consecutive times over an interval. Complementing these decisions 
are sequences of estimates of a failure and its time of occurrence , 

A A 

V(k) and 0 (k) . We can assume that the threshold has been chosen to 
eliminate the possibility of false alarms. The question is the following: 
with what degree of confidence can we accept these decisions , i-.e . , how 
certain can we be that in fact a failure of that type has occured? The 
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- problem is- an important one, especially if compensating action is to fol- 
low such a decision. Clearly, compensation for the wrong type of failure 
will, at best, not correct the source of failure. 

For example, m Chapter 2 it was pointed out that failures which 
can be modeled by a sensor step in a alter the residuals m a way not 
unlike a state jump failure m q. If , in response to- detection declared 
by the sensor step detector, a new sensor is activated when the actual 
failure originates m the actuator affecting the patch rate, nothing is 
achieved. The question involves looking at some of the fundamental 
limitations of the GLR method. 

In many situations additional information may be available which 
may resolve the ambiguity about the failure mode. One may, for example, 
have sufficient reason to believe that the a sensor m the above hypo- 
thetical situation is functioning properly (e.g. , we may have two a sensors 
that agree). For the rest of this chapter the assumption is made that 
no such extra information is available, and thus' we are considering 
what is decidedly a worst-case situation. 

Given the way the GLR technique works, one can expect that any 
non-random development in the innovations sequence Y (k) will result in 
increased values of £. (k,0) for the different i. Depending on the selec- 

i 

tion of parameters m the detectors, this may be followed by detection 

and estimation of the possible failures. In Chapter 1 the decision rule 

/\ 

max = £. (k,0. (k) ) > £ 
i 1 


(3.1) 
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was given, for a set of GLR detectors based on different failure mode 
hypotheses. This decision rule is very straightforward and appealing 
in its simplicity. Simulations for different failure conditions in- 
dicate, however, that it does not always choose the correct failure 

mode. In a number of cases the Z (k,0) for two different detectors 

1 

are close enough in value that the random influences from the noise be- 
come decisive. Although the correct failure mode may be selected, that 
decision carries a degree of uncertainty which might not be tolerable 
for many applications. 

The source of this cross-detection problem lies in the fact 
that failures of different modes may have signatures which are close, 
m some sense, to one another. An example has already been given. A 
decision rule such as (3.1) will work adequately in separating most 
jump failures from step failures, A step detector- will, in general, 
indicate less correlation (i.e . , lower values of (k , 0 ) ) with a jump 

failure than a jump detector would. Conversely, a step-like failure 
will correlate much better with both step detectors than with any jump 
failure signature. But one step failure of a particular mode may cor- 
relate almost as well with signatures for either state or sensor step 
failures. Thus, a real distinguishability problem exists between these 
modes . 

We saw in Chapter 2 how the patterns in the log-likelihood 
ratios £^(k,0) with respect to both arguments reflect the characteristics 
of the failure responses (the signatures) of the system to the various 
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modes. The analysis of the performance of the GLR system via the esti- 
2 

mates and 6 (k,0) for the correct and wrong times shows how those char- 
acteristics relate to the detectability of the failures. In section 3.2 
we observe how these quantitites change when the detector does not cor- 
respond to the correct failure mode. Then in section 3.3 some results 
from the simulations of the aircraft model are presented. A thorough 
study of the cross -detection problem is beyond the scope of this work, 
but we are able to shed light on this crucial issue and on some of the 
fundamental limitations of GLR, In section 3.4 is a brief discussion 
evaluating what other GLR formulations, the Constrained GLR (CGLR) in 
particular, may offer as a way out of this difficulty. Finally/ section 
3.5 sums up our treatment of the identifiability factor in the GLR and 
suggests the need for better decision rules . 

3.2 SOME ANALYSIS OF THE CROSS-DETECTION PROBLEM 

We begin our brief analysis of the identifiability of the dif- 
ferent failure modes by considering the response of the incorrect de- 
tector to a failure. Consider a GLR detector based on the hypothesis 

: y (k) = Y (k) + G^k^V (3.2) 

for a failure of type i starting at k=0^_. Suppose that the actual failure 
which occurs is of a different mode, j. Then the actual innovations 
in the filter will be 

Y(k) = YOO + (k,9 t )v 


(3.3) 
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In. order to understand what takes place in this situation, let us follow 
these residuals into the detectors and observe how their outputs are 
affected. 

First, we look at the matched filters for the times in the win- 
dow. The subscript l/j will denote quantitites in the i— detector when 
the residuals contain information from a failure of type j . So we have: 

k 

d i'| j (k ' 6 l 0 t ) G|(m,e}v' 1 (m)y(m) 

m^0 


G| {m,0)V 


-1 


(m) [y (m) 


+ G.(m,0 )v] 
3 


irt=8 


= d ± (k , 0 ) + (3.4) 

for each 0 in the window, k-M<0<k-N. This has the same form as in 
the correct detector situation (see (2.6)) but now 

k 

c i | j (k/ 0 !0 t > = XI (m , 8 ) V _1 (m) G ^ (m , 0^) (3.5) 

m=max (0,0) 

is the wrong-time, cross-detection information matrix . The mean value 
of each d ^ | ^ for all the 0's in the window at a given time k is shaped 
by the values of this matrix with 0 varying. For any 0 


E(di|.( k , 0 |e t )) = c. b (k,el 0 t )v 


(3.6) 
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and the log-likelihood ratios become 



(k,eje t ) = 


d' i . (k , 9 1 0 )C. 1 (k,0)d. | . (k,6]9 ) 
ib t x in t 


'(3.7) 


where C ^(kjQ) is the same as in (3.5) with 0=8 and i=T . We will use 
1 t 

this notation for simplicity 


C (k, 6) = C(k,6[0) (3.8) 

6 2 (k,0) = 6 2 (k,e|0) (3.9) 


when 0=0. 

t 

The wrong-time, cross-detection rion-centrality parameter for 
the likelxhood ratios (3.7) in the detector window, using (3.6), is 
then 

6 2 ,.(k, 0 | 0 ) = E(d. t . (k,0[0 )) 'C _1 (k,0)E{d. | (k,0|0 )> 

= VC! , . (k,0|0 )c7 1 (k,0)C. | . (k,0)0 )V (3.10) 

^ 1 3 r i 1 1 3 

2 

which for i=j reduces to the wrong- time (correct detector) <5 in (2.26) 

2 

and if 0=0^ it equals <5 in (2.13). The evolution of this term under 

different conditions gives us the sensitivity of the detectors to 

failures in other modes. As in the correct detection situation, such 

performance indices as delay times, false alarms and correct time 

2 

detection are related to the behavior of 6 , i . . 

1 b 

in a similar fashion, the estimate V of the failure under these 


conditions is given by 
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A , ^ A 

v. , (k) - c7 (k,e. j )<a , . (k,e. , j 
i ] i PI PI 1 I 3 


1 A A a 

= C. (k,0. 1 .) [d. (k,0. I .) + C. I . (k,0. | . |6 )V] (3.11) 

i i|] i ip i|) i ]' t 


with the expected value 


EcC.-.lk)) 



(k,0. j . ) C , . (k , 0 . j . 1 0 ) v 
l j 3 1 1 1 ip 1 t 


(3.12) 


where 0. t , is the estimate of the failure time obtained in the maximiza- 
i|3 

til 

tion of the likelihood ratios over 9 by the i— detector: 


A 



= arg max 
0eS 


• e i|3 (fc ' e l e t > 


S={0 J k-m<0<k-N } 


(3.13) 


All these quantities differ from their counterparts for the cor- 
rect detectors only in the role which the cross-detection information 
matrix plays. This quantity captures the relevant information concerning 
the correlation which exists between the modes of the detector .-and fail- 
ures . The nature of the response of a GLR detector to the "wrong" type 

of failure is largely determined by the characteristics of C. i . (k,0,0 ) 

- ip t 

as a function of its arguments. Its behavior as 0 and 0 vary can tell 

t 

A 

us the way the estimate will react, if detection takes place. 

We saw m Chapter 2 how the behavior of 6 , with 0 changing, reflects 
intrinsic properties of the mode of a failure. As a function of k, 

C i j j (and therefore <5^ | j ) indicates the sensitivity of the i — detector 
to the failure as time progresses. 

It is expected that if full advantage is taken of these charac- 
teristics of the cross-detection responses , modified decision rules may 
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be constructed which lessen the difficulties with distmguishability for 
the detectors. As Chapter 2 showed, detection may be very good assuming 
that the correct failure mode can be established (still with perfect 
knowledge of the parameters of the model) . 

The problem is illustrated in Figure 3.1. It presents the 

2 i 2 if 

6^i 0 (k, 00.) and (k, 00 ) profiles across a detector window 
2 | 2 t 4 I 2 t 

k-4O<0<k, for fixed k. A , 1(7 q state step failure is assumed to have 

2 

occurred at 0 =k-30. Notice that i _ r for the state step detector, 
t 2 | 2 

2 

has a clear peak at 0=8^ while ^ oes n °t in the sensor step detector. 

2 

Also note that for 0^0^ the wrong-time, cross-detection 6 can actually 

2 

be greater than the wrong-time correct detector S . "The physical in- 
terpretation of the situation is that a particular 'failure mode may not 
look much like another one occurring at the same time, but it may be 

highly correlated with the other mode started at a different time 

2 

[12] . As k varies, the 6 profiles over the window will vary for both 
detectors, It is this kind of information about the patterns m the 
V s for different detectors which can be used in modifying the GLR 
system to alleviate -cross -detection problems. Some other examples are 
given in section 3.3. 

f 2 2 

^2 1 2 and ^4 1 2 are t ^ ie non-centra ^ ; *- t y parameters of the state step (type 

2) and sensor step (type 4) detectors for a state step failure, as 
-given by the notation introduced in relation to equation (3.4) 
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Following the geometric interpretation of S in (2.24 ) , 

(k,0|e t )v 2 can be thought of as an inner product between the signa- 
ture of a type i failure at time 0 and a type j failure at 0^_. 


v 


v I C i|: (k ' 0 l 9 - )v '’ = <G , M r0jv.> 


t 2 


2 v _1 ( * ) 


(3.14) 


Thus, two failure modes having a large value in (3.14) (e.g., i=2 and 

j=4, state and sensor steps) are likely to have distinguishability 

difficulties. When’v'C.i \> is small (for example, i~2, j=3, state step 

1 i|] 2 “ 

and sensor jump) , we expect little or no problem with cross-detection. 

Performance probabilities can be defined in much the same way 

as in the case of correct detection. These now involve the distribution 

2 

values of Z. \ . (k, 0 1 0 ) around its expected value: 6. i plus the dr- 
ill t i|l 

mension of the failure space. The cross-detection probability is 
the probability that j exceeds the threshold for some failure of 
type j . P CD is a special case — where 0=0 1 — of the wrong-time , 
cross -detection probability P « Both of these are defined as follows. 


(k,i, j ,0,V) = Prob (£^ | j (k, 8 ) > e|h_.,0,v) 


p cw (k,i ' j ' 0 ' e t' v:) = Prob^i (k,8) > e|H j ,0 t ,v) 


(3.15) 

(3.16) 


These probabilities are increasing functions of 6^|_.as given in (3.10)'. If 
P CD 1S sma ^ ^ e *^* oP CD — P F^ m ° des are eas i 1 Y distinguished. If 

P^ d > p^, the two modes in question are highly correlated. Since the 
full GLR selects the most likely failure without restrictions , it may 
have difficulties with cross-detection. When the failure estimate is 
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constrained, to a specific set of directions (CGLR) or magnitudes (SGLR) , 
these probabilities will be restricted accordingly and the cross-detection 
problem may be greatly reduced. Thus, incorporating into the GLR formula- 
tion reasonable expectations about realistic, possible failures (directions 
and/or magnitudes) can result in improved overall performance in isolating 
failures. We will expand on this in section 3.4. 

3.3 CROSS-DETECTION SIMULATIONS 

3.3.1 The Likelihood Ratios 

In order to gain some concrete understanding of the difficulties 
of the GLR with failure mode distinguishability, we have made a number 
of cross-detection simulation runs. In addition to the correct GLR 
detector, other detectors based on different modes were implemented 
simultaneously. As the failures in different modes were simulated, the 
output and decisions of all detectors were recorded. .Particular emphasis 
.was placed on the distinguishability between state and sensor step failures . 
These are failure modes whose signatures are, in most cases, highly 
correlated (and which are modes that model failures of great practical 
interest) . 

If the correlation between the signatures of two failure .modes 
is i not -too pronounced,, simple decision rules,, such -as '(3.1), which com- 
pare the ■£' s of the detectors can effectively isolate the correct fail- 
ure mode. When the cross-detection difficulties are more severe,, how- 
ever, more sophisticated decision rules must be used. These must utilize 
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the information about the patterns in the £'s of each detector. The 
availability of the values of the £'s for all the 0’s in the window sug- 
gests that window decision rules should be used. A detection decision 
would then be made conditional on £(k,0) having a certain shape across 
the window (k— M<0<k-N) for any k. For example, a window decision can 
declare a failure at time k if K of the £’ s in the window exceed the 

A 

threshold at that time . Then 0 can be chosen as that value of 0 in the 
window with the largest £. Other rules can be similarly designed. 

Another reason for looking at window decision rules is to take 
full advantage of the structured behavior of the £'s as a function of 
0. It is clear from Chapter two that £(k>0) — for fixed k and varying 
9 — displays the differences between the signatures of the different 
modes . 

Decision rules that look at £(k,0) as a function of k are also 
possible. These rules can check for the growth in time of the likelihood 
ratios, which differs for the various failure modes. They can be de- 
signed to search for continued increase in the £'s — as for most 
step failures — or, for steady states — as for jump failures (or a 
sensor steps). The price, however, is that a certain waiting time is 
necessary before a decision can be made, since the £'s must be monitored 
over some specified interval of time. Also important is the 0 ( or 0's) 
m the windows for which this test applies. We have seen (in Chapter 2) 
how different the growth in £ can be, for some types of failures, for 
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two 0 1 s wide apart in the window . 

Let us look at the cross-detection problem between state step 

and sensor step failures. The generally persistent effects of these 

modes (Figures 2.4 and 2.5) on the residuals leads to indistinguishability 

difficulties. It is possible for both kinds of failures to elicit a 

similar response in the detectors for either mode. Figure 3.2, (a) and 

(b) , are plots of -^ 2 | 4 (k,0) for simulation rims of 100' sensor step 

failures in q and a (0 =5) . Compare these with the response of this 

t 

same state step detector to state step failures in q and a shown in Fig- 
ure 2.19, (a) and (b) . Notice the similarity in the patterns of the 
likelihood ratios in Figures 2.19 (a) and 3.2 (a), and- their differences 
in Figures 2.19 (b) and 3.2 (b) . 

A decision rule for the state step detector which declares a 
failure only if the JL's across the window at time k have the shape of 
the correct detector response (Figure 2.19, (a) and (b) ) , would work 
as follows if excited by a sensor step. If a sensor step in a (Fig- 
ure 3.2 (b) ) occurs, it would not satisfy the test and the state step 
detector would not declare a failure. The failure mode is easily dis- 
tinguished in this case. However, if the failure is a q sensor step? 
Figure 3.2 (a) indicates that it would be accepted by the state step 
detector and detection declared. Here the indistinguishability is more 
severe. Yet, the response of the correct detector (sensor step) to this 
same failure — shown in Figure 2.22 (a) — shows larger values for t 
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than the incorrect detector does* Hence, a comparison of the Z's for 
the two detectors can resolve the problem. 

Unfortunately, it is not always as simple as indicated. Figure 

i 

3.3, (a) and (b) , are plots of 1 4 (k,0) when the failures are lcr' 
sensor steps in q and a (0^=5) , The situation remains the same for the 
a failure: the wrong failure does not meet the requirement of the con- 
cave shape of the £'s across the window. But things are different for 
the q sensor step failure. Figure 2,21 (a) has the response to this 
failure of the (correct) sensor step detector. A simple comparison 
of the Z's in both detectors will not necessarily select the correct 
failure mode. The reason is that the difference between the non- 
centrality parameters of the correct and incorrect detectors, for a 
given failure, is proportional to the square of v (see equations (3.10) 
and (2.26)). Thus, this difference is larger in the case of the 100"’ 
sensor step failure. 

All this suggests is that information about the structure of 
the likelihood ratios cannot be used to resolve cross detection problems 
for all cases (perhaps their behavior with increasing k is also necessary) . 
We have seen that there are different degrees of indistinguishability . 
in particular, separating state steps from q sensor steps requires even 
more than testing the shape of the Z's across the window. Other infor- 

^*That is, the H of the state step detector in response to a sensor step 
failure . 
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Fig. 3.3(a) Likelihood Ratios: 1C q Sensor Step 
Failure; State Step Detector 



Fig. 3.3(b) 


Likelihood Ratios: Id' a Sensor Step 
Failure; State Step Detector 
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mation must be used. 

For example, compare the values- of the £'s achieved in Figures 
3.2 and 2.19. A state step failure with magnitude of the order of the 
noise m the dynamics actually results in much larger values than a sen- 
sor failure ten times the measurement noise. 

Thus, using a priori information as to what are physically mean- 
ingful failure sizes, we may set the threshold for the state step de- 
tector at a very high level — allowing for detection of reasonable size 
state step failures, but avoiding cross-detection of all except very 
large q-sensor step failures. The point here is that additional in- 
formation is available which can be used to distinguish modes. In the 
next section we look at another fact which helps alleviate the cross- 
detection difficulties. 

This discussion can be illustrated with the aid of Table 3.1. 

It summarizes the shapes of the likelihood ratio profiles over- the window 
of the state and sensor step detectors (i.e., £(k,0) versus 0 for fixed 
k) , for the correct and cross-detection combinations. We have char- 
acterized these , for simplicity, as either concave {as in Figure 3.2 (a)) 
or convex (as m Figure 3.2 (b) ) . The shape of the Z* s in the correct 
detector/failure combinations are underlined (entries #1, 2, 7 and 8). 

A decision rule which tests the Z' s for consistency with the correct 
patterns would easily distinguish a failure with a different shape 
(e.g., between entries #2 and 4 or between # 6 and 8). The real dis- 
tinguishability problem is then reduced to that between a q sensor step 
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and a q state step (entries # 1 and 3 or 5 and 7) . 


FAILURE 

STATE STEP DETECTOR 

SENSOR STEP DETECTOR 

state step 
in q 

1 

concave 

5 

concave 

state step 
in a 

** 2 ' 

concave 

** 6 

concave 

sensor step 
in q 

3 

concave 

7 

concave 

sensor step 
in a 

** 4 

convex 

** g 

convex 


TABLE 3.1 Likelihood Ratio Profiles Over Window 

The situation- for sensor step detectors is illustrated in Figure 
3.4 (a) and (b) . They are plots of | ^ (k,0 1 0^=5) when the failures are 
q, (a), and a, (b), state steps. These correspond to entries no. 5 and 6 
m Table 3.1. The response of this detector to sensor step failures can 
be seen m Figure 2.22 (corresponding to entries no. 7 and 8 in Table 
3.1). A similar decision rule would have no difficulty distinguishing 
a sensor step in a from the other failures. Again, it is a sensor 
step m q which gives rise to indistinguishability . 

We conclude that the indistinguishability between failure modes 
can be reduced in many cases by exploiting the distinctive patterns m 
the likelihood ratios . Thus the cross -detection problem is narrowed 
down to the more fundamental causes of difficulty. Other information 
m the GLR still remains unexamined which can further contribute to 
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£(k,e> 



F-ig. 3.4r(a) Likelihood Ratios: 10 g State Step 
Failure; ’Sensor Step ’Detector 


£.(k,0) 



Fig. 3.4(b) Likelihood Ratios: 10 q State Step 
Failure; Sensor Step Detector 



-141- 


alleviating these limitations . In the next section we look at the fail- 
ure estimates . 

3.3.2 The Failure Estimates 

In addition to the likelihood ratios, the estimates of the fail- 
ure have something important to say about cross-detection. We have 
seen that on the basis of the it's — using all the available information 
in the detectors — the distinguishability between different failure 
modes can be enhanced. Since the estimates of the failure (in the event 
of detection) are readily accessible, they offer a convenient source 

A 

of information. The quality and behavior of V(k) was seen in Chapter 
2 to reflect some of the characteristics of the signatures of the dif- 
ferent modes. In the case of an incorrect detector one might also expect 
.to see the estimates provide information indicative of the mode of a 
failure. 

In the simulations of the correct and incorrect detectors, the 
failure estimates were recorded whenever detection took place. Figures 
3.5 and 3.6 show the behavior of the failure estimates for the state 
and sensor step detectors when 10 state step failures were simulated 
in q and a. The correct estimate | ^ 00 slowly coverges to the vicinity 
of the true failure in the phase plane. The incorrect estimate 

A 

V 4 j 2 00, however, behaves quite differently. First of all, it con- 
verges to a point which indicates contributions to the failure from 
from q and a while 9 remains in the window. A decision rule which 




SENSOR STEP DETECTOR 



Fig. 3.5 Failure Estimates for la q State Step 
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only accepts failures that are physically meaningful — e.g., 

A 

failures only in q or in a — by monitoring the convergence of V, can 
be a substantial aid in identifying the correct failure mode. Notice 
that what such a rule amounts to is CGLR. 

A 

Also 'of interest is the reaction of V when 0 is no longer in 

the window. In these simulations (M=50, N=0, 0^=5) this occurs at k=55. 

A 

Notice that while V 2 [ 2 c * 13 ™? 63 slowly after 0^ is out of the window, 

A 

V 4 | 2 (k) goes through a sharp reversal m direction as soon as that time 

is reached. Also, the correct estimates tend to vary less before the 

end of the window is reached. This information about the incorrect esti- 
mate can be used if one is willing to wait the time necessary for 0 to 

leave the window (M-N+l time steps) before making a decision based on a 

1 

particular £(k, 0 ) for a fixed 0 and varying k. 

The kind of behavior shown here by the correct and incorrect 
failure 1 estimates, shows clearly that this information can further con- 
tribute towards identifying the true failure mode. Together with modi- 
fications which make use of the patterns m the Z's, the cross -detection 
problem can be systematically studied, ameliorated, and possibly, 
eliminated . 

3.4 DISTINGUISHABILITY WITH CGLR 

The observation made in the last section, concerning the behavior 
of the incorrect failure estimate, merits a closer look. In Figures 

3.5 and 3.6 it was seen how for the full GLR the incorrect estimates 
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V, | . differ from the correct detector estimates (for a sensor step de- 
tector and state step failure) . The failures simulated were orthogonal : 
failure in either q or a. Yet, the incorrect estimates approached — 
while 0^ remained in the window — an estimate indicating substantial 
components in both q and Ct. The full GLR detector chooses the estimate 

/s 

V which is most likely to have resulted in the maximum (over the window') 
likelihood ratio, assuming the particular failure mode hypothesized by 

A 

the detector in fact occurred. It is free to choose V as any point in 
the failure space of appropriate dimension. This raises the following 
question: how much better would the constrained GLR (CGLR) or the 
simplified GLR (SGLR) perform with respect to distinguishability problems? 
The assumption that these formulations will, in fact, do at least as 
well as the full GLR is discussed below. The comments in this section 
refer to the CGLR and it is expected that many of them carry over to 
SGLR as well. 

The CGLR (and SGLR) formulation was discussed briefly in Chapter 
1. We saw that it consists of computing, for each failure mode, the 
likelihood ratios and failure estimates along specific directions : 

A A 

V=$f , where f is one out of a set of possible failure directions and 
m m 

A 

3 is an estimate of the magnitude of the failure along f (i.e., a 

scaling factor) . We note that when a failure occurs in the assumed 

2 

direction, f , the (S in the CGLR corresponding to that direction should 

2 

be the same as for the full GLR (In CGLR a 6 (m) is associated with 
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every direction f ) . This is true, asstaming that the correct mode is 

2 A 

known. When V=$f m the full GLR, the expressions for 6 and E(V) coin- 
m 

aide with those for CGLR. 

In most applications the physically meaningful failures are not 
likely to be "free" — i.e., with V totally unknown. For example, a 
failure in a particular sensor may be independent of the other measure- 
ments. Restricting the search for failures to a set of specific directions 
should reduce idle uncertainty in identifying the actual failures. In 
a cross detection situation between modes with considerable distinguish- 
ability problems, the potential gains in using CGLR are very appealing. 
Suppose, in reference to the results in Figures 3.5 and 3.6, that the 
incorrect detector had been constrained to pure q and pure a failures . 

In all probability, then the incorrect £. i ,’s along those directions 

1 1 3 

would be appreciably smaller than the £'' s for the correct detector. 

The reason for this is the following. For the full GLR the incorrect 
>\ 

detector estimate V. i . — the most likely type i failure which accounts 

^ 1 3 

for the achieved — required a mixed q and a failure. Constrained 

to orthogonal failure directions, the likelihood ratios would have to 
be lower in value, and hence they would be smaller than the £’s in 
the correct detector, which should not change too much (as they tend 
toward predominately q or a failure estimates. 

Thus, a comparison between the capabilities of full GLR and 
CGLR should be investigated m order to gain a better understanding of 
the tradeoffs vis a vis cross-dection. Since the dominant failure modes 
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and directions in any application are given to us, the design limitations 
of the GLR are very much context-dependent. Hence, further work on this 
question should concentrate on developing a systematic treatment of these 
limitations and tradeoffs between full GLR and CGLR (and, by extension, 
SGLR) . 

The likelihood ratios and failure estimates in CGLR are computed 
only for failures in certain directions which are specified beforehand 
(see Chapter 1, section 1.2). Thus, for every failure mode the cor- 
responding CGLR detector searches along these directions and selects 
the one in which a failure is most likely to have occurred. A scheme 
in which the outputs of all detectors are compared for each failure 

direction can then be studied by means of analysis and simulation. For 

2 

example, one can evaluate 6 for the state step and sensor step detectors 

2 

m the q and a directions in CGLR and compare them to <5 in the full GLR 
for those same detectors. The wrong-time, cross-detection version of 
these quantities then tell us what can be gained by using CGLR as far 
as failure mode distinguishability is concerned. 

The general expression for the wrong-time, correct detector 
5 and failure estimate in CGLR are 


£(k,0|0 , m) 


b (k,8|0 t ,m) 
a(k,0|m) 


POO 



(3.17) 


(3.18) 
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where 


b(k, ©le , m) = ra(k,e|e t ) 


a (k , 0 1 m) = f;C(k,0)f m 


(3.19) 

(3.20) 


and f is the m — failure direction (i.e., V=$f ). 
m m 

leads to a residual sequence 


The actual failure 


Y(k) = Y (k) + $G (k ,0 )'f 

t m 


(3.21) 


Corresponding to (3.17) and (3.18), we have 


x 2 . 3 2 (f'C’(k,0|e.)f ) 2 

o (m) - m t m 

f’C(k,9)f 

m in 

= g 2 a 2 (k,e|0 t ) 


'(3.22) 


a(k,0) 


and 


■E(g) 


g a(k.,e|e t ) 


(3.23) 


■a'(kv 9 ) 


In a cross-detection situation, for a fixed direction, the 
expressions for these quantities become 




£ ; c i (k ' 0 > f m 


(3.24) 


and 
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E(B) 


b f'c . (k,e ejf 

m 1 i t m 

f’c (k,6)f 

m x m 


(3.25) 


Comparxng these quantxtxes with those given by (3.17) and (3.18) 

for f xn the q and a directxons will tell us how well the CGLR handles 
m 

dxstxnguxshability between failure modes with correlated signatures. 
Comparxng them to the correspondxng ones xn full GLR then indicates the 
relative advantages in cross-detection between the two GLR formulatxons . 
A similar kind of analysis can be performed with respect to simplified 
GLR to see how further restrictxon to include the magnitude of V affects 
distinguishability. Finally, we note that (3.24) and (3.25) can be 
expanded to include the case where, in addition, the failure is in a 
direction f other than the one hypothesized in the detector. 

3.5 CROSS-DETECTION; DISCUSSION 

This concludes our brief look into the difficulties with the 
GLR technique in distinguishing between several failure modes. We have 
seen some of the fundamental limitations of this approach. The nature 
of this indistinguishability — similar behavior of the residuals under 
different failure conditions — is built into the GLR technique since 
it searches for specific developments in the residuals. 

There are several ways to deal with these difficulties in de- 
termining which is the true mode of a failure. The main consideration 
common to all is the realization of the fact that the principal design 
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limitations with the GLR are very much context-dependent. Therefore, 
efforts to improve detection must take advantage of the way in which 
these dependencies are displayed in the various quantities computed 
m the detectors. In one approach, full use should be made of all 
available information concerning the £' s and the estimates. The patterned 
behavior of these quantities for the correct detector can be used ef- 
fectively to provide increased distinguishability . The design of "smart" 
decision rules, which check for this distinctive kind of behavior con- 
sistent with the hypothesized failure mode, can eliminate or restrict 
many of the limitations of this method. 

Another approach, complementary to the use of modified decision 
rules, is the search for the most applicable GLR formulation for the 
problem at hand. The flexibility offered by full, constrained and 
simplified GLR allows us to provide a better match to our knowledge 
about the system and failures . The assumptions about the failures .which 
can he made on physical considerations motivate the various restrictions 
on v made by SGLR, CGLr and full GLR. If only a particular failure can 
occur., or if its origin must necessarily be related to specific points 
in the systems, such information should be acknowledged explicitly in 
selecting the detector formulation , Further work .with .the GLR techni- 
que should 'concentrate on development of a methodology with which to 
select the best design, .for a given situation, m a systematic fashion. 



CHAPTER 4 


SENSITIVITY TO MODELLING ERRORS 

4. 1 DETECTION UNDER MISMATCHED CONDITIONS 

In this chapter we consider the sensitivity of the performance of 

the GLR detectors to modeling errors. Up to now we have assumed that the 

model of the system used to compute the Kalman filter gains and detector 

matrices is exact: all parameters are perfectly known. In previous chapters 

we have examined the detection performance of the GLR under this assumption. 

The concern over the issue of modeling errors is motivated by two 

> 

important considerations: 

. one can never really measure the model parameters exactly, 
and, m fact, the model is often a vast mathematical 
simplification of the physical system 

. even if one could, the true system parameters are likely to 
have some time-varying behavior 

With respect to the first of these, one would like to know the relation- 
ship between quality of detection and the accuracy to which the system 

* 

parameters are known. Perhaps of more importance, however, is the .second 

4 k * 

observation. In many' applications the true system drifts slowly away 
from the dynamical system specified by the model. Or, the true system 
is only approximated by the model for certain regions in the state space. 

For example, the F-8C model used here consists of a sequence of linear, 
time-invariant systems corresponding to different flight conditions 
along the flight trajectory. A more exact representation of the air- 
craft would be a nonlinear dynamic system [16] . 
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In order to develop some intuition into the possible implications 
of modeling errors for reliability in detection via the GLR r some analysis 
and simulations were carried out. These results are only preliminary., 
and much more work remains to be done. However, we feel that some of 
the basic issues have been identified and that it is possible to deal 
with the problem of parameter errors in a number of ways. 

Finally, we view the subject of this chapter as a further look 
at the basic limitations of the GLR technique. Some of the difficulties 
in distinguishing between failure modes were demonstrated in Chapter 3. 

In fact, it will be seen that an analogous situation exists between cer- 
tain other failure modes — hard-over sensor failures in particular — 
and the kind of modeling errors considered here. Therefore, on the one 
hand we learn about the effect of these errors on performance and on 
the other we can view this as providing insight into failures (Chapter 
1, section- l.,2) using detectors' based on the^simpler models — such as 
the step detectors. 

Reference to the term 'mismatch' in this chapter denotes the 
situation where some or all of the model parameters on which the de- 
tectors and the filter are based are in error. 

4.2 THE FILTER MATCHED TO THE DETECTOR 

4.2.1 Description of Mismatch 

In approaching the sensitivity of GLR performance to modeling 
errors, an analytical treatment becomes intractable very quickly. We 
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therefore rely substantially on the use of simulations . The simulation 
program MDSP ([13] and Chapter 2, section 2.3.1) easily accomodates 
various forms of mismatches . The detectors and filter can each be com- 
puted based on the same model of the system as the true one, or, on 
another one which can be specified. For our purposes reduced-order models 
for the F-8C aircraft were used, for flight conditions 10 and 12 (Chapter 
1, section 1.2.1 and [16]). These correspond to flight at Mach 0.4 and 
Mach 0.8, respectively, with the same altitude and weather conditions as 
flight condition 11 (20,000 feet and cumulus clouds). 

The most significant differences between these three models are: 

* the H term changes approximately by a factor, of 2 from each 
fligh? a condition to the next (due to marked changes in dyna- 
mic pressure) 

• the $ matrix changes ,so that the period of the aircraft os- 
cillations increases by almost 50% from condition 12 to 
condition 11, and again from condition 11 to condition 10. 

We note that these are fairly large modeling -errors and therefore we are 
considering extreme, but meaningful, situations. Table 4.1 summarizes 
the parameters of the model and Kalman- filter corresponding to flight 
condition 12 (the parameters for flight condition 11 are given in 
section 1.2., 2). All the results reported in this chapter involve a 
mismatch between flight conditions 11 and 12 . 

The period of oscillation of these two models are approximately 

92 (3 sec.) and 67 (2 sec) time steps respectively. The H term, 
which doubles from flight condition 11 to condition 12, depends on the 
dynamic pressure and thus the velocity. We use flight condition 12 
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rather than 10 for the real system because 12 has a shorter period. Hence, 
the effects that depend on this are likely to happen faster. 

4.2.2 Complete Mismatch 

We first look at the case where the detector and the filter are 

calculated based on the same flight condition which differs from the 

true system (on which the measurements are made) . This is a realistic 

situation since the filter gams and .detector matrices must be either 

generated on-line or kept in storage. However, it is an idealization 

of the actual situation since the true system is likely to be gradually 

changing. It is impossible to obtain them for every change in the 

actual system. So we only assume that the system model is "near enough" 

to the real system to be meaningful. The case where the filter gains, 

but not the detectors, can be matched to the true system is discussed 
♦ 

briefly in section 4.4. 

In order to understand how detection performance is affected by 

A A 

the modeling errors we look at the way Y, %, 0 and V change. We can 
then infer the probable rates of false alarms ,, detection delays, etc. 

We begin with the behavior of the residuals under mismatch. Since the 
■Kalman filter is not matched to the system, these innovations need no 
longer be a white noise process m the absence of failures (although 
whiteness in the residuals is not a sufficient condition to. declare 
a model exact, as is pointed out in [17]). 

Figure 4.1 gives plots of the residuals for simulation runs 
where the true system is at flight condition 12 while the filter and 
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Fig. 4.1(b) Mean Value of Residuals in 
Fig. 4.1(a) 
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detector are computed for flight condition 11. Figure 4.1 (a) shows the 
actual residuals generated, and in 4.1 (b) the same residuals are shown 
for a deterministic run ( all noises equal zero for all k) . Both are the 
residuals of the unfailed system. The latter indicates how the mean val- 
ue of the residuals responds to the mismatch. Both of these correspond 
to the system started at an initial condition with q(0)=0 and a(0)=5°, 
the reason for which, will be discussed shortly . By deleting the noises 
we have isolated the pure effect of the mismatch on the residuals. The 
relationship between this oscillatory behavior m Y and the system dy- 
namics is explored later on in this chapter. 

This kind of behavior in the residuals suggests how the GLR de- 
tectors will be sensitive to modeling errors . To the extent that the 
residuals over some interval of time resemble the failure signatures for 
some mode, false alarms will increase. The likelihood ratios in the 
state step and sensor step detectors for these residuals are plotted 
in Figures 4.2 (a) and 4.2 (b) . Notice, first of all, the large values 
of the £'s in both detectors. Thus, false alarms will surely occur 
(assuming the use of an instantaneous decision rule) . Furthermore, 
notice the peculiar nature of the patterns in the it * s , involving os- 
cillatory behavior in both k and 0. . The latter fact should not sur- 
prise us, given the oscillations in the residuals and that £(k,0) is 
a quadratic function of yOO* 

Consider the £'s in Figure 4.2(a) as they develop with increasing 

A 

k. At first only the first peak is in the window and a 0 will correspond 
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Fig. 4.2(a) Likelihood Ratios Under Mismatch: 
No Failure; State Step Detector 


£(k,0> 





Fig. 4.2(b) Likelihood Ratios Under Mismatch: 
No Failure; Sensor Step Detector 
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to its largest value. Later, as the first peak dies out and a new one 

A A 

appears for later 0's, 0 undergoes an abrupt shift. As we know, V also 

/v 

changes sharply for such behavior m 0. The correlation between the 
£'s for 0’s wide apart can be quite small. In Figure 4.3(a) we have 

A 

plotted 0(k) corresponding to the likelihood ratios, shown m Figure 

A 

4.2(a), for the state step detector under mismatch. The estimate 0 for 
the sensor step detector, under similar conditions, is shown in Fig. 
4.3(b). In the first case, the estimate of the declared failure under- 
goes a large discontinuity. This increase equals the distance in 0 
between the two peaks observed in the &*s in Fig. 4.2(a) . The estimate 

A 

0 in the sensor step detector behaves quite differently, as do the 
&'s shown m Fig. 4.2(b). 

Two comments can be made based on these observations. In the 
case of the state step detector. Figures 4.2(a) and 4.3(a) suggest 

✓v 

that sudden, large shifts in 0, corresponding to times within the 
window, are indicative of a mismatch situation. Furthermore, the size 
of the shift A0 is a function of the period in the &*s and thus, is 
directly related to the oscillations in the residuals. The importance 
of this fact should become clear in the discussion which follows . On 
the other hand, m the case of the sensor step detector (Figures 4.2(b) 

A 

and 4.3(b)) 0 (k) is indistinguishable from the estimated time of an 

A 

actual failure, as it consistently selects the same value for 0(k). 
Hence, other information must be used in this case to distinguish be- 


tween a real failure and simply a condition of mismatch. This information 
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A 

must come from the failure estimates V (k) and/or from the patterns of 

the likelihood ratios (from this detector and from the state step detector) . 

The distinctive shapes of the Jl's in Fig. 4.2 indicates that the 
kind of decision rules suggested in the last chapter (in relation to 
cross-detection) might prove useful here also. For example, under mis- 
match the Si's at times exibit more than one peak across the window simul- 

S 

taneously . This was never seen before m detection of failures of any 
kind under matched conditions. Similar comments apply to decision rules 
which look at the behavior of the £'s with time. 

Let us consider the nature of the changes in the residuals m re- 
sponse to the mismatch. Suppose that the real system can be described 
by 


x(k+l) 

- $ x x(k) + r iW (k) 

(4.1) 

z(k) 

= H^x(k) + v(k) 

(4.2) 


where w(k) and v(k) are the same Gaussian white noise sequences given in 
Chapter 1. 

If the Kalman filter is based on a system model with H and 
T instead of <£^,1-1^ and r , the estimates in the filter are given by 

rv a 

x(k+l) = $(I-KH)x(k) + OKz(k) 

A 

= <Hl— KH)x(k) + $ KH x(k) + §Kv(k) 

A 

= §(I-KH)x(k) + §KHx(k) + $KAHX (k) + $Kv(k) (4.3) 


where 
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x(k) = x(k|k-l) 


(4.4) 


and z(k) in (4.3) comes from (4.2). If we now let 


$ = $ + A$ 

H 1 = H + AH 

r = t + Ar 

we can express ‘the residual in the filter: 

A 

y (k) = z(k-) - Hx(k-) 

= ,('H + AH)x(k*) - Hx-(k) + v(k) 

Letting e('k) denote 'the estimation error 

A 

e (k) = x,(k) - x>(k) 

then 

e>Ck+l) = $(I-KH) e (k) + (r+ADw(k)+ A$x(k) 
- <SKv(k) - $KAHx (k) 

and 


(4.5) 

(4.6) 

(4.7) 


(4.8) 


(4.9) 


(4.10) 


Y (k) = He (k) + AHx(k) + v(k) 


(4 -.ID 


Thus, we can think of the residuals as the output of an augmented 
system with state vector 


e (k+1) 
_x (k+l)_ 


$(I-KH) 

A<$-#kAh 

. 0 

$+A$ 


~e(k) 

!Tw(k) -$1^(10 

_x(k}_ 

L rw( k) 


(4.12) 
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y(k) = eh Ah] 


e (k)' 
x(k) 


+ v(k) 


(4.13) 


Assuming that $(I-KH) is a stable matrix with real eigenvalues, e(k) 
and y(k) oscillate when forced by x(k) , and therefore at a frequency 
determined by $+A l l = < $^, i.e. , the real system. If the eigenvalues of 
$(I-KH) are not real, then the previous statement still holds, but the 
behavior of e (k) in equation (4.10) will show mixed oscillatory modes. 

Returning to our example, 3>(I-KH) for flight condition 11 is a 
stable matrix with real eigenvalues as shown by equation (1.65). The 
residuals m Figure 4.1 in fact oscillate with a period close to 
that of $ in flight condition 12. The initial condition in a was chosen 
to provide the maximum possible effect, as Ah in equation (4.11) is of 
the form: < 


Ah 



0 


(4.14) 


It should be pointed out that the value of that initial condition 
(q(0)=0, a(0)=5°) is quite large: a{0)=5° has a value twenty times the 
standard deviation of the noise in* the a dynamics. Therefore, it is 
expected that the effects of mismatch will be less apparent for a more 
subdued state trajectory. 

Finally, m Figure 4.4(a) and 4.4(b), we present the £'s under 
mismatch between the same two flight conditions — and for no failures — 
when the initial condition is one in q: q(0) = 26°/sec (20(7) and 
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a(0) = 0. Although there are some differences in the magnitude of the 
&'s achieved and, for the sensor step detector, in their shape, all our 
earlier observations apply equally well here. The interaction between 
q and a through the dynamics results in similar responses in the detectors , 
as the pitch rate q is integrated into angle-of— attack a. 

In the next section we consider the case when failures occur while 
a condition of mismatch prevails. 

4.2.3 Failure Detection Under Complete Mismatch 

In the last section we saw how the sensitivity of the GLR detectors 
to modeling errors can result in large values of the likelihood ratios , 
and consequently in false alarms . The response of the detectors to the 
mismatch was seen to have very definite characteristics, as well as to 
be quite dependent on the state of the system. 

In order to determine how detection might be affected when a failure 

does occur under these conditions , a number of simulation runs were made 

for different failures and initial conditions. Figure 4.5(a) shows the 

£'s in the state detector m response to a Iff state step failure in q. 

The initial condition was q(0)=0, a(0)=5° and 0 =5 was the failure time. 

t 

The £'s in Figure 4.5(b) correspond to the same kind of failure and 
mismatch, but for q(0)=0 and a(0)=-5°. The unfailed, mismatched response 
of the same detector, for comparison, was given in Figure 4.2(a). While 
the oscillatory behavior of the &'s due to the mismatch are clearly 
present, it is worth noticing that they (the £'s) are actually growing 



Fig. 4.5(a) Likelihood Ratios Under Mismatch 
lcr q State Step Failure? State 
State Detector 

&(k,0) 










Fig. 4.5(b) Likelihood Ratios Under Mismatch: 
10 q State Step Failure; State 
Step Detector 
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with. time. This is in contrast to the unfailed case where they are 
expected to decrease with time, in line with the decaying tendency shown 
by the residuals in Figure 4.1. The reason for the decrease in the 
residuals is that these oscillations depend on x(k) (see equations 
(4.10) and (4.11)). Since the system is stable, the effects of the 
initial conditions diminish with time, m the absence of any forcing 
input. Notice that this "free" response of the system is mainly de- 
termined by the initial state (the noise disturbances are the other 
factor) . 

Figure 4.5(b) shows the £ 1 s , also from the state step detector, 
for the same failure when the system is started at a different value 
of the state. While the same comments apply, note the larger values 
of the £'s and the apparent change in the oscillations. Figures 4.6(a) 
and 4.6(b) show the ft's in the sensor step detector in response to a 
lb' q sensor step failure, with the same two initial conditions. Notice 
that observations can be made analogous to those for the state step 
detector. One difference is that for the initial condition with 
&(0)=— 5°, the likelhood ratios are actually smaller than m the unfailed 
case shown in Figure 4.2(b). The effect of the q failure on the value 
of a is opposite that of the negative initial conditions. Both tend to 
cancel out somewhat the effect on the residuals. 

These simulations indicate that detection is still possible under 
mismatch, although not without difficulties. The increasing, although 
oscillatory, nature of the &'s for failures under these conditions imply 
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Fig. 4.6(b) Likelihood Ratios Under Mismatch: la q Sensor 
Step Failure; Sensor Step Detector 
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contmued detectability of the failure. By raising the threshold to a 
very high value we can insure that only failures can lead to detection. 

The large thresholds necessary to guarantee this will lead to increased 
delays before a failure can be detected, or decreased probability of 
detection. However, we have seen in Chapter 2 that step failures, state 
steps in particular, of moderate size result in extremely high values 
of the 2.' s very quickly. Therefore the real problem is that modeling 
errors may limit the smallest failures we can hope to detect. 

The dependence of the il's on the values of the state of the 
system is a factor which is unique to the condition of mismatch; it 
was not seen before in matched detection analysis and results . As with 
the likelihood ratio, the estimates of the failure and failure time 

y\ A s 

V and 0, also depend on the state. 

Since some of the failures enter into the state of the system — 
state gump and state step failures — the behavior of the outputs of 
the detectors for those failures is more sensitive to the state tra- 
jectory than the detectors for the sensor failures. 

Figures 4.7 and 4.8 display the likelihood ratios under the mis- 
match between flight conditions 11 and 12 for a step failures (0^=5) 
in the state and sensors. Figures 4.7(a) and 4.8(a) show the Si's in 
both the state step and sensor step detectors for an a initial condition 
of 5°. The corresponding detector response to the same failures for an 
initial condition of a=-5° is shown in Figures 4.7(b) and 4.8(b). As 
before, the differences in the state lead to changes in the 2,’s. However, 
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Fxg. 4.7(a) Likelihood Ratios Under Mismatch: 10 a State 
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Fig. 4.7(b) 




Likelihood Ratios Under Mismatch: 10 a State 
Step Failure; State Step Detector 
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Fig. 4.8(a) Likelihood Ratios Under Mismatch: 10' a Sensor 
Step Failure; Sensor Step Detector 





Fig, 4.8(b) Likelihood Ratios Under Mismatch: la* a Sensor 
Step Failure; Sensor Step Detector 
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compare 'the resulting changes in the Jl's due to the different state of 
the system in Figures 4.5 and 4.7 to those changes observed m Figures 
4.6 and 4.8. We can see that 

* the way in which the £'s respond to the differences in the 
state is not the same for both detectors s in one case they 
increase and they decrease in the other 

• the V s in the state step detector change by as much as 100% 
depending on the state, for the same failure; the Vs m the 
sensor step detector only differ by about 25% (the value of 
the state can tend to cancel out part of the failure when it 
is a state failure — but not when it is a sensor failure) 

Knowledge of these characteristics of the detector responses in the pre- 
sence of modeling errors can be used to advantage, once understood m more 
detail. 

Just as in the case of cross-detection (Chapter 3) , the best way 
to deal with these difficulties is the full use of the behavior of the 

/v A 

. Vs, and the -estimates V(lc) ‘and 0 (k) . The maximum likelihood’ inter- 
pretation of these quantities for the various detector hypotheses can 
tell us something about the activity of the ‘residuals, and, hence, also 
about the behavior of the real system. It may be possible to use all 
this information in an integrated manner in connection with a scheme for 
system identification. 

Finally-, in Figures 4.9, (a) and (b), , we show the estimates of the 
failure time for the state step detector. The failures are a 1CT g state 
step (Figure 4.9 (a)) and a la a state step (Figure 4.9 (b) ) and 0=5 
for both. They are given the initial condition in a of 5° and also -5°. 
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We notice that the kind of failure — failure in q or in a — can enhance 

A 

or diminish the differences between the resulting 0{k)'s for two different 
values of the initial state. Compare these plots to the unfailed response 
of the same detector for an initial condition m a of 5° , shown in Figure 
4. 3 (a) . 

First of all, notice that the failure m a (Fig. 4.9(b)) overrides 
the effect of the mismatch to some extent and maintains a consistent 

A 

0, for both state trajectories. The failure in q, on the other hand 
(Fig. 4.9(a)), shows erratic estimates not too different from the unfailed 
estimate in Figure 4.3(a). It must be kept in mind, however, that these 
are small failures and thus the problem is expected to be less severe for 

A 

larger failures. Also of interest is the way that the sequence 8(k) dif- 
fers, for the same failure and detector, for two separate state paths. 

This is particularly evident in Figure 4.9(a). A more detailed analysis 
of this state dependence might prove fruitful. It may tell us if we may 
corroborate a detection decision by deliberate perturbation of the actual 
flight trajectory. 

Although the data presented here is limited to a few situations 
of special interest, we feel that our observations can be generalized. A 
more complete study of this sensitivity to modeling inaccuracies should 
be rewarding. In the next section we look at another possible approach 
to improving detection under mismatch. 
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4.3 PARTIAL MISMATCH: AH 

4.3.1 Compensation for AH 

It was pointed out in section 4.2.1 that one of the major parameter 
errors in the mismatch between flight conditions corresponds the H term 
of the observation matrix. A number of simulations were made where the 
only mismatch between the system model and the actual system consisted 
of the difference m the H. The detector and filter were based on flight 
condition 11. The real system was the same, except that the H was that 
of flight condition 12. 

Figures 4.10(a) and 4.10(b) show these £'s under the same conditions 
as m Figure 4.2: no failure 'and an initial condition in a of 5°. The 

great similarity to the previous likelihood ratios, under the complete 
mismatch between the flight conditions, makes it clear that it is in fact 
H which contributes, in our case, to the main effect. Thus, if one could 
correct for this parameter error, one would expect to be able to miti- 
gate greatly the sensitivity to the mismatch. 

It was mentioned earlier that the H term, which is the only one 
, aa 

contributing toward Ah (see equation (4.13)), is a function of the dyna- 
mic pressure. Hence, if one can determine the actual H by some means — 
such as measuring dynamic pressure directly — one may be able to com- 
pensate for Ah. Figures 4.11 and 4.12 display the Z' s in the state step 
and sensor step detectors for a complete mismatch where Ah has been 
compensated for (i.e., the actual A H=0) . There is no failure in either 
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Fig. 4.12(a) Likelihood Ratios for Partially Compensated 
Mismatch: No Failure; State Step Detector 
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Fig. 4.12(b) Likelihood Ratios for Partially Compensated 
Mismatch: No Failure , Sensor Step Detector 
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case. The -£'s in Figure 4.11 correspond to the system started at an 
a ( 20 a) initial condition and for the Z's in Figure 4.12 the system 
started with a 20cr q initial condition (a=0) . Note that in both cases 
the values of the £'s are significantly smaller than m the cases where 
there was no such compensation (Figures 4.2 and 4.4) . Selecting a high 
threshold can eliminate the false alarms without significantly diminishing 
the capability for detecting failures. 

If we recognize that our example consists of relatively large 
modeling errors and initial conditions, these results suggest that in 
many cases it may be possible to isolate the main source of the dif- 
ficulties and to eliminate them. 

4.3.2 Approximate Analysis of Complete Mismatch 

We mentioned earlier that analytical treatment of the sensitivity 
of GLR performance to modeling errors is in general intractable. To 
consider changes in all parameters of the system and their effects on the 
filter residuals results in too large a burden which overrides any gain 
in clarity or understanding of the situation. However, some analysis 
may be possible in those cases where adequate approximations can be made. 
In this section we present some expressions obtained, for the aircraft 
example, by recognizing the dominant sources of the mismatch. 

In section 4.3.1 it was pointed out that for our example the 
dominant parameter error was Ah.' This term accounts for the major trends 


in the behavior of the residuals under mismatch. Figure 4.10 shows that 
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Ah alone produces a response in the I's of the GLR detectors which is 
qualitatively similar to that shown in Figure 4.2 for the complete mis- 
match. In Appendix B we have calculated the change in the residual due 
to the presence of the Ah between the true system and the model in the 
filter (which is the same as for the detector) . 

The residuals in the Kalman filter, expressed in terms of the resid- 
uals for the matched, un failed case (y (k) ) , are then given by 

k 

y(k) = y(k) + y ^ A(k,&)x(&) (4.15) 

£=0 

where 

A(k,k) = AH (4.16) 

A(k,£) = X $kAH , Kk (4.17) 

and 

0 = $(I-KH) ' ' (4.18) 


0 is recognized to be the transition matrix of the Kalman filter. 

Note that this is another expression for the 1 residuals in (4.13) 
and that the dependence on the past and present values of the state is 
made explicit. The quantities which go into A(k,&) are all known and 
thus it is not hard to compute A for increasing values of T=k-&. If 
knowledge of Ah can be obtained, or if we can estimate it, it 'may be .possible 
to filter out a large part of the non-white component of the residuals in 
(4.15) by subtracting out values computed with an approximation with a 
small number of terms in that convolution. This pre-filtering would pro- 
vide the new residuals to be used by the detectors : 
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= W k > - 12 A < k '«*«l« 

A=k-T 


(4.19) 


where A and T are to be optimized. We must use the estimate x(k|k) since 
we do not have x. 

otherwise, the effect of the residuals in (4.15) on the likelihood 
ratios of the GLR detectors (for AH) can be calculated, as m Appendix 
B, to bet 

k 


E (£ (k, 0) ) = tr 


^ ^ L(k,0; j , j)V<}) 


+ 2 tr 


k k j min(£-l,h-l) 

ZZZE L(k, 0 ;h,j)A(D,£)$ £ a “ 1 r I” (uQ h 1 " 1 
Lh =9 3=0 Z=0 i=0 


+ tr 


' k k j m \ ' 

[_j=6 m=0 £=0 n=0 


where 



V(j) = HP(j)H’ + R 
P (j) = E (e ( j ) e ( j ) ’ ) 

L(k,8;h,3) = V~ 1 (h) G (h,0)C — 1 (k,0 ) G* { j ,0 ) V*” 1 ( j) 


(4.21) 

(4.22) 

(4.23) 


e(k), 0 and A are given by equations (4.9) and (4.15)-(4.18) and x Q =x(0) . 


Thus we find that even for the idealized mismatch with only AH, 
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the analysis of the likelihood ratios is not a trivial exercise. Hence, 
our heavy reliance on simulations is justified as the more immediate and 
useful approach. Based on the observed patterns in the behavior of the 
various detector outputs, 'smart' decision rules must be designed and 
tested for improved performance. Otherwise some form of compensation 
must be implemented either by the pre-filtering suggested above or by 
means of the suggestion in section 4.3.1 (correcting for the dominant 
parameter by directly measuring it, whenever possible) . 

In the next section we look briefly at another kind of mismatch 
where the analysis becomes somewhat simpler. 

4.4 fHS FILTER MATCHED TO THE SYSTEM 

So far in this chapter, all the discussion on the limitations of 
the GLR technique arising from inaccuracies in the modeling of the system 
of interest has been related to what we call complete mismatch (section 
4.2.2). The same model is used to calculate the detector matrices and 
the gains in the Kalman filter. 

Another possibility is having the filter gains matched to the 
dynamics of the real system and the detector quantities based on the 
system model. This becomes feasible if the GLR. detection system operates 
simultaneously with an identification scheme — e.g. , the multiple model 
adaptive control method (MMAC) [18 3 , which is capable of, choosing a Kalman 
filter for the correct flight condition. The detectors for a given flight 
condition consists of a sequence of matrices (G(r) , C(r); r=0,l, ...r M-N+l) 
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for the interval in the window. Therefore it is desirable to have detectors 

for a limited number of' flight conditions. 

Consider the system given by equations (4.1) and (4.2),. Suppose, 

again, that the only difference between this system and its model m the 

detector is that the latter assumes a value H, while the actual observation 

d 

matrix is 


H — H + AH (4.24) 

s d 

The subject (•) denotes quantities corresponding to the real system while 
(' ) ^ denotes quantities based on the model of the detector . 

The Kalman filter is matched to the system — i.e., it is based on 


H . 
s 

In the absence of failures, the filter residuals will form a white 
noise process. However, let vis express y(k) in terms of the model in the 
detector: 


Or, 


Y (k) = z (k) - H x,(k) 
s s s 

A 

= (H + AH)x(k) - (H + AH)x(k) + v(k) 
d d 

= He (k) * v(k) + AHe(k) 

d 

= y (k) + AHe(k) 

= Y (k) 
s 


Y s ( k) 


(4.25) 


= y (k) + AHe(k) 
d 


(4.26) 



where x(k) and e (R) 


— the predicted state estimate and estimation error 


are defined in equations (4.4) and (4.9). 

If we compute the expected value of the likelihood ratios in the 
GLR detectors, based on , for these residuals corresponding to H , we 

obtain (in the absence of failures) : 


k 

j=e 

where L(k, 0; 3 ) = L(k,0? j, j) 

V = H PH* + R 

5 S3 

= (h + Ah) p (h^ + Ah) 1 + r 

d d 

= H PH' + R + H.PAH’ + AHPH. + AHPAH ' 
d d d d 

= V. + Av 
d 

AV = H.PAH' + AHPH' + AhpAh' 

d d 


(k,0) ) = tr 


E 


L(k, 0; j) 


V s ( 3 ) 


(4.27) 


(4.28) 


(4.29) 

(4.30) 


L(k, 0; j, j) is defined in (4.23), P in (4.22), and is as in (4.21). 

a 

■The expression & d | s refers to the unfailed likelihood ratio as described 
.above and is derived in Appendix C. Thus, we have 


Ea d'|s ( ' k,0)> = 


k 


0; j) v g (3‘),: 


= tr 


j=e 

k 


= tr 


T>, e? j)(v d (-j.) + Av(joo i 


^L(k, 0; ])V d (D) 

b=0 


k 


+ tr 


L(k, 9; j)AV(j)] 

U= B 
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The last equality follows from the result in Chapter 2 for the matched 
detection case. Hence, the difference in the £'s in the detectors, due 
to the error in their model value for H, leads to an increase m the 
value of the unfailed likelihood ratios. To the extent that Ah is the 
most significant modeling error. 


A = Ea d j s (k,6)) - E(& d (k,0)) 



6; 


j)Av(j) 


(4.32) 


predicts the changes needed in the threshold in order to maintain the 

same detection probabilities (P and p ) as in the case when the detector 

a. F 

is perfectly matched to the system. Notice the Av, and thus A, can be 
precomputed . 

In contrast to the complete, mismatch situation in the previous 
part of this chapter, the approximate analysis for this other kind of 
detector mismatch is_ feasible. An analysis of the failure detection 
performance of the detectors under these conditions can be developed 
much like in the case of cross -detection m Chapter 3, In Appendix C 
the following expressions are also derived: 

k 

E(d d | s (k; 0)) = E(^ G^(:,0)v" 1 (j)Y s (j)) = C d | s (k,6)V (4.33) 

j=e 

5^ js (k,0) 


(4.34) 
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E(v . (k)) = C~ 1 (k, 0., (k))C,i (k, 0 . (k))V (4.35) 

d|s d d[s d|s d|s 

and 

A 

0^i (k, 6) = arg max (k,0) (4.36) 

0 

where 

k 

C d j s (k,0) - ^ G^(j,6)v“la) G g (j,0) (4.37) 

j=e 

and is the signature based on H=H^. Notice the similarity in form to 
the same quantities in cross -detection given by equations (3.6) , (3.10) , 
(3.12), (3.13) and (3.5), in that order. 

Thus, if one can isolate the parameter error which contributes 
the most to the detector sensitivity, a thorough, although approximate, 
analysis of the effects on detection is possible. In conjunction with 
an adaptive estimation control system such as MMAC [18], this may be an 
attractive approach to dealing' with the sensitivity to modeling errors. 

4.5 DISCUSSION OF MODELING ERRORS AND THE- GLR 

In this chapter we have examined some of the implications of in- 
accuracies in the model parameters used to compute the Kalman filter 
and detector matrices. This completes our discussion of the limitations 
inherent in the GLR techniques , which we began in Chapter 3 by looking 
at distinguishability between the failure modes. 

We have looked at the complete mismatch situation -- i.e., where 
the filter and detector are confuted for the same model — and, found that 
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indeed detection is very sensitive to such errors. However, in view of 
the i large parameter errors assumed, and in the' manner in which performance 
is affected, it is felt that the degradation an detection, which may re- 
sult can be dealt with effectively (i.e., compensating for the modeling 
errors) . It was seen that the detector outputs — the £’s, 0(k) and 

A 

V(k) — are affected by the mismatch in a way which is characteristic 
of the true system. Thus, "smart" decision rules can be constructed 
which minimize the possibility of false alarms, much as in the case of 
cross-detection. In addition, some of the information in these outputs 
may be useful for an identification system. 

The correlations in the residuals induced by the parameter errors , 
even in the absence of failures, are very distinctive. Although analysis 
of this kind of mismatch is not tractable, it may be possible to isolate 
the dominant source of error by means of simulations. The results pre- - 
sented with our example indicate that some form of compensation for such 
errors can reduce the difficulties significantly. In any event, it was 
seen how parameter errors lead to residual signatures much like those 
of actual failures. In fact, some modeling errors are equivalent to 
some of the more complex failure modes mentioned in Chapter 1 — e.g., 
an error Ah is seen to be the same as the Hard-over sensor failure. Un- 
like the simpler failures considered throughout this thesis, the likeli- 
hood ratios now depend on the state of the system. This is one of the 
reasons for the distinctive manner in which the GLR detectors react, 
corresponding to the actual dynamics associated with the state trajectory. 
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Viewed in this light, we see that it is possible to detect, and perhaps 
identify, the more complex failures with detectors based on elementary 
additive failure models. 

Finally, another kind of mismatch was briefly considered where 
analysis and compensation seems tractable. If in conjunction with an 
identification technique the filter gains can be made to correspond 
to the true system, the residuals may remain nearly uncorrelated. We 
examined an example where the dominant parameter error was assumed to be 
the only mismatch. The unfailed response of the detectors can then he 
corrected by a simple change in the threshold. In the event of failure, 
the characteristics of the detector outputs can be studied analytically, 
much as in the cross-detection problem considered in the last chapter. 



CHAPTER 5 


CONCLUSIONS AND RECOMMENDATIONS FOR FUTURE RESEARCH 

5.1 CONCLUSIONS 
\ 

We have examined in detail the performance of the generalized 
likelihood ratio (GLR) technique for failure detection. In particular, 
we have looked at the full GLR formulation (in which no information about 
the failure vector V is available) and have applied it to a reduced-order 
model of the longitudinal dynamics of the F-8C aircraft. A number of failure 
models have been introduced and the performance of the GLR detectors cor- 
responding to four basic failure modes has been discussed at length. 

A qualitative examination of the performance of the full GLR for 
this application has been made. It has been directed toward an evalu- 
ation of the capability of this technique to extract information about 
the failure, and to the degradation which results from parameter uncer- 
tainties. Extensive use of simulations has complemented the analysis 
of this method. 

The failure signatures and GLR detectors for some simple failure 
modes — state jumps and steps, sensor jumps and steps — have been 
analyzed and discussed in detail. The performance of the full GLR, as 
measured by such indices as 

. false alarm rates 

. detection delays 

. ability to distinguish among the various failure modes 

. sensitivity to modeling errors 
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indicates great sensitivity to failures. In most cases (including very 
small failures) the thresholds can be chosen to guarantee fast detection 
with few, if any, false alarms. This is true as long as the modeling 
is accurate. Nevertheless, even under these conditions there are cross- 
detection problems, i.e., difficulties in selecting the true mode of a 
failure from among failure modes with correlated signatures. The problem 
exists if one simply looks at the values of the likelihood ratios for 
single times (as opposed to their values over intervals- of time) . 

The simulations verify the analysis under matched conditions (exact 
modeling) and suggest ways to deal with the difficulties. The distinctive 
patterns in the likelihood ratios indicate that it is possible to develop 
more sophisticated, or "smart" , decision rules which make full use of the 
available information. These rules — which remain to be formulated — 
should be able to improve detection performance. The basis for these 
rules is to look for specific behavior of the likelihood ratios, and of 
the estimates of the failure and its time of occurrence, which is char- 
acteristic of each mode. The joint detection, isolation, and estimation 
of failures can greatly improve overall detection performance (i.e., 
lower false alarm rates, etc.). When looked at as simultaneous tasks, 
rather than sequential operations — i.e., first detect, then isolate 
the failure mode and- finally estimate the failure — better use is ifiade 
of the available information. 

These comments apply whether distinguishability between failure 
modes or the effects of parameter errors is the main concern. The 
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development of such modified decision rules is related to the use of other 
GLB. formulations. It was seen that where full GLR can have serious di$- 
tmguishability difficulties, the CGLR (and possibly the SGLR) can be of 
great utility. 

Our 1 experience with the GLR method up to now suggests that it is 
a useful and reliable technique for the detection of failures , or abrupt 
system changes. The performance of the GLR method can be studied an- 
alytically [12] : the analysis becomes simpler for the more restrictive 
formulation of SGLR. In addition, we have seen that GLR can be success- 
fully examined by way of simulations. Using both approaches, the GLR 
offers ample flexibility in the range of implementations possible. This 
allows us to match the technique to the available information about the 
system and the failures of interest. 

5.2 SUGGESTIONS FOR FURTHER WORK 

Based on the results obtained, it is felt that future efforts should 
concentrate on the following immediate issues: 

• The study of the correlations between the £^01,9) for the 
different failure modes. New analytical techniques and per- 
formance measures are needed with which to develop and evaluate 
the suggested "smart" decision rules. 

• The development of modifications to the signatures in order 

to increase the distinguishability of the failure modes . 

* • •<% -* . I( 

The concepts of "orthogonal" signatures on the one hand (to 
minimize cross-detection effects) , and "universal" signatures 
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(signatures which can detect all or groups of the faxlures 
of interest) on the other should be explored further. 
Computational and storage savings are issues which can 
also be dealt with by means of modifications in the de- 
tectors . 

* Further study of the sensitivity to parameter errors and of 
the more complex failure models is needed. Their inter- 
connections are important to understand and can contribute 
to the analysis of "smart" decision rules. 

* Work should continue with CGLR and SGLR. It may be possible 
to obtain improved failure mode distinguishability and reduced 
sensitivity to parameter errors by looking for failures in 
specific directions (and/or magnitudes) only. 

On a more distant horizon, work should continue toward: 

* An integrated study of the options offered by the various 
GLR formulations, as part of an overall design methodology 
for maximum utilization of the characteristics of each system. 

* The study of tradeoffs between the use of these techniques 
which rely on analytical redundancy and simpler detection 
systems relying on hardware redundancy. These complexity- 
performance tradeoffs should be examined in the light of 
the GLR and compared to other methods for failure detection. 

* Finally, an evaluation of the performance of such failure 
detection systems within an overall scheme of self-organizing 
control systems which automatically restructure themselves 

as compensation to failures in the system. The criteria 
with which to critically consider the performance of failure 
detection systems can be different for closed- loop operation. 
For example, the "price" of a false alarm or delayed detection 
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can be quite different (from an open-loop situation) if these 
decisions are used in a feedback control system. 



APPENDIX A 


THE FAILURE SIGNATURES FOR FAILURE MODELS 1-4 

The failure signature matrices G^(k,0) are presented here for 
the following failure modes; state jumps, state steps, sensor jumps 
and sensor steps (failure models 1-4 m Chapter 1) . These expressions 


are derived by Chow ( [ 12 ] , Chapter 2) . 

For the linear dynamic system 

x(k+l) = $(k)x(k) + w(k) (A.l) 

z (k) = H(k)x(k) + v(k) (A. 2) 

and Kalman-Bucy filter based on the no-failure hypothesis, 

x(k+l|k) = $ (k)x(k|k) (A. 3) 

‘ x(k|k) = x(k|k-l) + K(k)y(k) (A. 4) 

with K(k) , the optimal gains (see (1-18) - (1-21) , the measurement 
residuals are 

y(k) = -y(k) (A. 5) 


where Y(k) is a white noise process. In the event of a failure v at 
time 0 in one of the above modes we can write, by linearity, 

Y(k) = Y(k) + s(k,v,0) (A. 6) 

s (k,V, 0) = G(k,0)V (A. 7) 

where G(k,0) is non-zero for k>0 and satisfy the following recursive 
equations. The matrix F(k,0) used below is defined by 

x(k|k) = x^klk) + x 2 (k|k) (A. 8) 


- 194 - 



-195- 


x 2 (k|k) = F(k f 0)v s (A. 9) 

where x^(k|k) is the 'unfaxled' estimate and x^CkJk) is due solely to 

»■ 

the failure. 0(k»k-l) is the filter transition matrix for the updated 
estimated in (A. 4) . 


0(k,k-l) = 0(k-l) = [I-K(k)H(k)]$ (k-1) 

0{k,j) = 0(k-l)0(k-2) ... 0C j) 

* 

<Mk,j) = <&(k)$(k-l) ... $(j) 

The signatures are: 

State Jump Failures (Mode 1) 


k<6 


F.^,0) = 


| ^ ^ 0(k,j)K(j)H(j)$(j,0> k>9 

j-0 


G 1 (k,6) = 


k<e 


H(k)[$(k,0)- $(k,k-l)F 1 (k-1, 9) ] k>0 


State Step Failure (Mode 2) 


k<0 


.k k 


EE 0(k, j)K(j)H(j)$(j,i 
i=0 j=i 


i) k>0 


(A. 10) 
(A. 11) 
(A. 12) 


(A. 13) 


(A. 14) 


F 2 (k f 0) » 


(A. 15) 
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k<8 


G^ (k, 0) — 


H(k> 


^jHk,j) - $(k,k-l)P 2 (k-l # 0> 
_j=0 


k>0 


Sensor Jump Failure (mode 3) 


F 3 (k,0) = 


, 0 (k, 0) K(0) 


k<0 

k>0 


G 3 (k,0) =<I 


O-H (k) $ (k ,k-l) F 3 (k-1 , 0 ) 


Sensor Step Failure (mode 4) 


k<0 

k=0 

k>0 


k<0 


F 4 (k,0) -<V e( k fj ,K(j: 

[j=0 


k>0 


G 4 (k,0) — \ I 


tJ-H (k) $ (k f k-1 ) F (k-1 , 0 ) 


k<0 

k=0 

k>8 


(A. 16) 


(A. 17) 


(A. 18) 


(A. 19) 


(A. 20) 



APPENDIX B 


Approximate Analysis of the Likelihood Ratios: Partial Mismatch 
(in H) with the Filter Matched to the GLR Detectors 

I. The Residuals 

Consider the following dynamical system: 

x(k+l) = $x(k) + Fw(k) (B.l) 

z (k) = Hx{k) + v(k) (B.2) 

with w(k) and v{k) uncorrelated, white noise sequences with zero 
mean value and covariance matrices: 


EtwfiJw'fj)) = IS. . 

(B.3) 

E (v(i)v'(j ) ) = l6 

(B . 4) 


The corresponding residuals in the optimal Kalman-Bucy filter for 
this system, with z (k) as input to the filter, are given by 

~ A 

y(k) = z(k) - z(k|k-l) 

= z(k) - Hx(k |k-l) (B.5) 

where x(k[k-l) is the (one-step) prediction of the state which is the 
optimal estimate of x(k) based on the values of z(i) up to and including 
z(k-l). When the filter has reached steady-state, it evolves with the 
following dynamics: 

x(k+l|k) = $x(k|k-l) + $K[z(k)-Hx(k|k-l)] (B.6) 

where K is the steady-state optimal gain (see equations (1.15)- (1.17) ) . 
Rearranging terms we obtain the equivalent formulation: 



-198- 


x(k+l|k) = [$-<&KH] x (k j k— 1) + $Kz(k) (B.7) 

or, letting 

0=O(I-KH), (B. 8 ) 

the filter transition matrix, we obtain, 

x(k+l|k) - 0 x(k[k-l) + $Kz(k) ( B . 9 ) 

which is the steady-state equation for the optimal estimate. 

The (non-recursive) solutions of (B.l) and (B.9) express x(k) and 

A 

x(k|k-l) as follows : 

k -1 

x(k) = $ k x Q + ^ $ k_A-1 rw(il) (B.10) 

Sa=0 

k -1 

x(k|k-i) = e k x 0 e k ‘*'" 1 fe 2 a) ( B . id 

Z=0 

where 

x Q = x (0) , x (0) = x(0 j -1) (B.12) 

If, instead of the observations given by (B.2) , the actual input 
to the filter is 


z 1 (k) = (H + AH) x (k) + v(k) 

= Hx(k) + v(k) + AHx(k) 

= z(k) + AHx (k) , (-B.130 

then and (B . 11 ) changes to 

k -1 

^(kjk-1) = 0 k x Q + e k ~^~ 1 < ? )K [ 2 + AHx ( 5 ,) ] 

£=0 

k -1 ' - . 

= x(k|k-l) +^2 0^"* f ‘ 1 *KAHx(A) (B.14) 

£=0 
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The actual residuals m the Kalman Bucy filter can now be ex- 
pressed (using (B. 5 ) , (B.13) and (B.14)) as 

Y-j_00 = z^(k) - Hx^kjk-l) 


k-1 

= z (k)-Hx(k| k-1) + Ahx (k) - ^ 0 k " 5 '~ 1 § K AHx («.) 

£=0 


k-i 

= Y(k) + AHx(k) - G^^fKAHxU) (B.15) 

£=0 


or, more generally, 

k 

Y 1 (k) = yOO + V' A(k,£)x(£) 

il=0 


with 


A(k,A) 


( Ah 

(-H0 k ' £ “ 1 <i>KAH 


k=£ 


k>& 


(B.16) 


(B.17) 


II. The Log-Likelihood Ratios 

The 'detector equation giving the log-likelihood ratios, we recall 
from Chapter 1, 


£{k,0) = d* (k/e)c“ 1 (k,e)d(k,0) 

(B.18) 

k 


d(k,8) = y; G* (j,6)V~ 1 (j)Y(j) 

(B.19) 

j=e 



k 

c (k,6) =^G , (j,e)v“ 1 (j)G(j,0) 


(B. 20) 
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When the GLR detectors are computed assuming z(k) as m (B.2) but, instead, 
we have 2 ^(k) as i n (B.13), we can compute the effect or change m E(£(k,0)) 
Substituting Y 1 (j ) from (B.16) for y(j) in (B.19), 

k j 

d(k,9)^ G ' (j , Q) V -1 (j ) [y( 3 ) 

sj=o 


rAlxU) ] 


k k j 

T. GMjfQJv^CjJy^) +y (j,9)v _1 (jH(j,Jl>xU) 

j-6 j=e £=o 


k 3 

= d(k,0) + Yy'y (j,9)V~ 1 (j)A(j,fc)x(&) 


(B .21) 


where d(k,6) denotes the quantity that would be obtained were everything 
matched (i.e., if AH=0) . 


From (B.18), the log-likelihood ratios can be evaluated with the 
use of (B .21) : 


-1, 


. k 3 

A{k,0) = fd(k,0) + yy? (j ,9)V~ x (j) A(] ,£)x(&) 

j=9 £=0 

k j 

d(k,6) + y] y>- (j ,6)V~ 2 (j)A(j ,ft)x(&) 
j=9 0=0 

r k j 


'CT 1 (k,9) 


= A(k?6) + 2d' (k,0)C _1 {k,0) 


k ^ 


y 2js‘(g,e)v" 1 (j)A(j,)i)x(ji) 
[_j=9 £=0 


££ G’ (i,9)v" 1 (j}A(j,£)x(£) 


3=9 £=0 


1 C 1 (k , 9 ) ' 


- 1 , 


EE G’ { j , 9) V (g ) A(j ,£}x(£,) 

L j“6 a=o 


(B.22) 
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where £(k,0) denotes the log-likelihood ratios corresponding to d(k,6). 

In order to evaluate the expected value of £(k,0), E(£(k,0)), 
we proceed with one term at a time. Let us express (B.22) as 


E (£{k,0) ) = E + 2E 2 + E 3 


(B.23) 


then, taking the terms in order: 


E x = E (£ (k,0) ) 


= E(dXk,0)C 1 (k,0)d(k,6)} 

'k 


= E 


« E 


= E 


\ y g’ fj,e)v 

j=6 

_k 

y> (j)v _ 1 (j)G{j,e) 

L>=0 

k k 

\ V \ V (i)L{k,0; i 

L^L J 

4=0 j=o 


* C _1 (k , 0 ) 


yy (j,0)v _i ( j ) y (d ) 

j=0 


c" 1 (k,0) 


b“0 


6)V _1 (j)Y(j) 


o)Y(j) 


fB. 24) 


where we define 


L (k, 0; i, j) = V 1 (i)G(i,0)C -1 (k,0)G' (j,0)V _1 (D)' 


(B.25) 


for simplicity. 

Continuing with (B.24) , applying the expectation to each term in 
the sum. 


E l a E (£ (k,0) ) 


k k 



E(Y’ <i)L(k,0;i, j)Y(j) ) 


l=W 
k k 


tr[L(k,0;i,j)E(Y(i)Y* (J>)1 

i=9 j=0 


(B. 26) 



where we have used the property of the expectation operator by which 


E (x' Ay) = tr[AE(yx' ) ] 


{B. 27) 


Since the residuals in the Kalman-Bucy filter are uncorrelated, we have 

0 i^3 


E(y(i)Y' (j) ) = 


V(j) i=j 


(B » 28) 


and consequently, 
k 

E i = ^ t r L’(k , 0 ; j,j)V(j) 
• 

~ 3s 

^ (k , 0 ; j ,j)V(j) 

j=0 


= tr 


Proceeding to the second term in (B.22): 

r k j 


ii) E 2 = E[d' (k,0)c“i(k,0) 


Y'T]g’{ :, ,0)v" 1 (j) A(j ,£)x(£) 
j=0~&=O 


(B . 29 ) 


y 

fk ^ 


-k j 

E ( 

(h) v" 1 (h)G (h, 0) 

C" 1 (k,6) 

y ^ y > {j/Qjv" 1 tj) A(j ,z)x(i) 


h=0 


3=0 &=0 

L. J J 


/k k j 

■ - E £ X > ' (h)L(k,0;h,j}A(j,Jl)x(«.) 

\ h =0 j =0 &=0 

where use was made of (B.25). Continuing, 
k k j 

e 2 = ^ y^y^ trlLtk^^^jAC^iDECxCA)^ (h) ) ] 

h=0 j=0 £=0 


(B.30) 


(B . 31) 
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where, usxng (B.10) , 


/Z-l 


■V _ ~ 

B (x{&) Y 1 (h) ) = E($ x Y'(h)) + E| 


Y 1 r W (i)Y‘ (h)J 


1=0 


£,-1 




TE (w (x) Y' (h)) 


fB.32) 


i=0 


by linearity of the expectation, and assuming that x Q and y are un- 
correlated (since is assumed uncorrelated with both w and v in (B.l) 
and (B . 2 ) ) ♦ 

In order to obtain the value -of E(«(i)Y' (h)) we need the following 
expressions: 

^ /\ 

Y(k) = z(k) - Hx(k|k-1) 

= Hx(k) + v(k) - Hx(k[k-1) 

= He(kjk-l) + v(k) (B.33) 


e(k|k-l) = x(k) - x(k k-1) 


and 


k-1 


eltlc-l) = 0 k e Q + £ e *- 1 ’ 1 


[Tw(r) - $Kv(r)] 


c=0 


(B . 34) 


(B. 35) 


Equation (B.35) can be derived from' equations (B.l), <B.2), (B.7) and 
(B.34). Then, by (B.33), 


E (w (i)Y' (h)‘) = E (w (i)e' (h]h-l) )H' + e (w (x) v' (h) ) 
= E (w (i) e' (h j h— 1) ) H' 


(B.36) 
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sxnce the noises u) and v are uncorrelated for all times. Therefore, 


E{w<i)y(h)) = 


E (w(i) e' ) [0 h ] 'H* 
h-1 

+ E(w(i) Yy (r )I" (0 h ~ r ~ 1 ) ' ] )H* 


r=0 

h-1 


+ E (w (i) v' (r)K' <$’ (0 h r ~ 1 ) ' ] )H' 


r=0 


h-1 


’» tpri 


^ E (w (i)w ’ (r))r* (0 11 * ') *H' 
r=0 


[H0 h 1 ^T] 1 


r=i, i<h-l 


otherwise 


{B. 37) 


due to the fact that: 1) to and e Q are uncorrelated, 2) equation (B.3) 

Consequently, (B.32) becomes 
5,-1 

E(x(5,)r (h)> « yy & ~ i ~ 1 rr t (0 h-i_1 ) *h* 

i=0 


(B.38) 


and from (B.31) , is given by 


k k j min (5,-1, h-1) 

e 2 = y^y^y\ rtL(k,9;h,i)A(j,5,) t y^ ^-i-i r r« iQh-i-i] , H . 

h=0 j=0 Z=0 


i-0 


=tr EEEE L(k,e ; h,j)A(j,£)^" i ~ 1 rr' (f* 1 " 1 " 1 ) *h* 


k k j min (£-l,h-l) 

ELSE 

h=e j=9 < 1=0 i =0 


(B . 39) 


where the limits on the sums are constrained to values such that the 

. Finally we get to the third term, E 3 , in (B.23). 


expression makes sense 
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iii) We will need the cross-correlation function for x(}c) . For x(k) 
as given in (B.l), with X Q = Efx^x^'), 


/ 

n-1 



A-l 

E (x(n)x' (£,)) = El 

$ n x^ + ^ # n S 1 Fw(s) 


$ x Q 

, V"' Jl-t-1 

r»<t) 

\ 

s=o 


- 

t=o -1 


min(n-l,£-l) 

= $ n X n ( ©n-s-ipr, ($ a-s_1 ) « (b.40) 

s=0 


There, using (B.22) , E^ becomes 


E 3 = E 


= tr 


k k j m 

XLEE x' (fc)A' (j ,£)L(k,0; j ,m) A(m,n)x(n)j 
yj=0 m=0 &=0 n=0 

k k j m 

EXZL L(k,0? j ,m)A(m,n)E{x(n)x' (£) )A' {j ,£) 
l_j=0 m=8 &=0 n=o 


= tr 


' k k j m 

"y ^ 'y \ (k,8; j ,m)A(m, 
l_j=0 m=0 £=0 n=0 


n) • 


( ' min(&-l,n-l) \ 

$ n x Q ($ V + V' $ n-s-l rr • ($• !l ~ s ~ 1 ) MA 1 (j,£) 

V t* / 

(B.41) 

We now have a full expression for E(&(k,0}) for a. mismatch in H, 


as given by (B.22) and’ (B.23) . E^, E^ and E^ are given by (B.29), (B.39) 


and (B.41) , respectively. 



APPENDIX C 


APPROXIMATE ANALYSIS: PARTIAL MISMATCH (IN H) WITH 
THE FILTER MATCHED TO THE SYSTEM 

I. Without Failures 

Suppose that for a system represented by 

x(k+l) « x(k) + w(k) (C.l) 

z, (k) = H x (k) + v(k) (C. 2) 

a a 

GLR detectors are computed for some failure mode. However, let us 
assume that the actual system observations really correspond to 

z (k) = H x(k) + v(k) 
s s 

= (H d + AH)x(k) + v(k) 

= z(k) + AHx(k) (C . 3) 

with H g also being the value used in the Kalman-Bucy filter equations 
for the estimates and. optimal gains . 

The residuals in the filter form an uncorrelated, white noise 
process with zero mean and with covariance 

CovCy(k)) = E(7(k)y‘ (k) ) 

= H P(klk-1)H T + R 
s s 

= V s (k) (C.4) 

where P (k k-1) is the predicted covariance of the estimate error , ; and 
R, the covariance matrix of v(k) . We have 
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V k) 


= (k) - H s x(k|k-1) 

= (H, + Ah) x(k) - (H + AH)x(k) 
d d 

/\ A 

= H^(x(Jc) - x(k[k-l)) + AH(x(k) - x(k|k-l)) + v(k) 


(c. 5) 


or, 

■v A 

Y (k) « Y.Ck) + AH(x{k) - x(k |k-l) ) 
s d 

where Y, denotes 
d 


~ /\ 

Y d (3c) = H d (x(k)-x(k|k-D) + v{k) 

A 

= z d (k) - H d x(k|k-1) 


(C.6) 


(C.7) 


which would be their value if Ah=0. 

We will now see the effect on the GLR detectors. The subscript 

d/s will indicate quantities in a detector (which is based on H^) 

when the residuals for its input are y (k) . First, in the absence 

s 

of failure's (from (B.18) - (B.20)), 
k 

v.< k - e > - 

j=e 

k 

= G^(j,0)v' 1 (j) tY a C j J + AH(x(j) - x(j|j-l))] 

j=0 

k k 

= S G d (j ' 6)V d 1(j) ^d (j)+ X) G d (:, ' 0>V d 1C:3) - AHfx( ^-^3[j-l)] 

j=0 j=0 


= d (k,0) + Ad (k,6) 

a 


(C.8) 
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where we let 

k 

Ad{k,0) =^G^(3,e)V~ 1 (j)Ay(j) (C.9) 

1=0 

A 

Ay(j) *= AH[x(j) - x(j|j-l)] 

= AHe(jJ]-l) (C.10) 

Then the log- likelihood ratios become 

£ d|s (k,8) = d d|s (k,0)C d 1(k,0)d d|s (k,e) <C.11> 

= fd,<k,0) + Aa<k,0)] ’C^tk/e) [d,(k,9) + Ad(k,0)] 
a ad 

= d' (k,9)c" i {k,0)d J (k,e) + d’ {k,e)c“ 1 (k / 0)Ad(k,e) 
dad d d 

-1 ~ -1 
+ Ad' (k,0)C (k,0) d (k,0) + Ad' (k^C, (k,0) Ad(k,0) 

d d d 

or 

A d|s (k ' 0) = V k,9) +AJUk,6) + A£'(k,0) + A 2 £(k,0) (C.12) 

with 

A£<k,0) = d,’ (k^Jc^tk^jAdCk,©) (C.13) 

a a 

A 2 A(k,0) = Ad’ (k,O)C~ 1 <k,0)Ad(k,0) (C.14) 

‘ a 

C, is the detector information matrix and d_, £, are d and £ for 
d d d 

Ah=o. 

If we take expectations in (C.12) , 

E(£^j s (k,0)) “ \ + e 2 + ^' 2 + E 3 (C.15) 


where 
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E(i d (k,6) 


k 


tr [y> ^ L(k,0; j,j)V d (g)] 

(C.16) 

• j=6 


E(A£(k,6) ) 

(C.17) 

E(A 2 £(k,0)) 

(C.18) 


The expression for L in (C.16) was given in appendix B, (B. 25) . 

If we proceed to evaluate E^r using (C.13) : 

e 2 = E<d^(k,e)c" 1 (k,e)Ad(k,e)) 

k k 

- E ( [y>- ( i f 6) v- 1 (1 > y d (i) ] * c" 1 (k , e ) , 0) vj: j ) Ay ( j ) ] ) 

i=8 j=8 

k k 

= Y d (i)v d lci)G d (i,e)c d 1 (k,e)G d cj ' 0 )v d 1(j)AT(j)) 

i=0 -j=0 

k k 

-EE Y^(i)L (k,0;i,j)Ay (j) ) (C.19) 

i=9 j=-0 


With the use of (C.10) we obtain, by linearity, 
k k 

B 2 =£ } * E(Y d (i)L(k,6;i, j)AH[x(j)-x(j j j-1) ] ) 

i =0 j=e 


k k 

^ \ r [L (k,0;i, j) AHE{ [x(j)-x( j | j-1) 3 Y^ (i) ) J 
i=0 j.=9 


k 


=tr 


i*=6 



L(k,0; i, j ) Ahe (e ( j j j-1) Y^ (j)) 3 


(C. 20) 



- 210 - 


where 


E (e (3 | j-l)Y^ (i) = E(e(j 1,5-1) [H e(ijl-l) + v(i)]') 

= E {e ( j ( 3 - 1 ) e' (i| 1-1) ) + E (e ( j { j-1) v' (i) ) 

j'pCjjj-DH^ i=j 

(0 (C.21) 


We have made use of the facts that the optimal error is not correlated 
with itself shifted in time, nor with v(i) for any time. 

Consequently, the expression for E^ becomes 
k 

E 2 = (k,8? j,j)Affi»(j ]j-l)H’] (C.22) 

j=0 

and similarly, 

k 

E 2 = tr ty^ L tk,e ; j,j)H^P(jlj-l)AH'1 (C.23) 

j=9 

Finally, Eg is given by 

E 3 = E(Ad* (k,0)Ad(k,6)) 

k k 

= E C [>Ay 1 (i) v~ L (i) G d (i, 6) ] c" 1 Ck,6 ) (j ,9) v' 1 { j ) Ay (j ) ] ) 

i=0 j=0 

k k. 

= y^y^ E(e’ (i[i-l)AH*L(k,e?i,j)AHe{j j j-1)) 

i=e ]*e 

k k 

“ / J tr [L (k, 0 ; 1 , j ) AhE (e ( j [ j-l)e* {i|i-l)AH'] 

iwv mmrnm 

i»0 j«0 
k 

= trI ^^ L(k,9; j,j)AHP(j j j-l)AH‘ ] 

j=6 


(C.24) 
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where we have used (C.9) , (C.10) , and since E (e ( 3 | j-l)e ' (i j i-1) ) = 0 
for i^j . 

Collecting Ey E^ and E 3 for E (^ a 1 3 ) in (C.15), we obtain 
(with (C. 16) , (C.22)~ (C.24)) , 

k 

S<A d|B ac,e)) = tr[^^L(k,0;:,j) (V fi (j) + AHP (;) |d-1)H^ 


+ H d P(j j-i) A h' + Ahp ( j | ]-i) A h* ) ] 


(C. 25) 


and by substituting the expression for V,(j) 

d 


V j) = H ^ p <3|j-l)H' + R 


(C.26) 


and regrouping terms in (C.25), 

k 

E(£ djs (k,6)) = tr[y^L(k,e ; j,j) (R -t- [H d +AH]P(j|j-l) [H d +AH] ')] 

j-e 

k 

= tr \ ] L(k r 9 ; j,j) (H P { j | j-l)H' + R) ] 

s s 

j=9 


= tr[J^ L(k,9;j,j)V s (j)] 
9=6 


(C.27) 


by use of (C.4). 


II. With Failures 

If a failure V takes place at time 0 the residuals change and 


can be represented as 
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Y (k) = Y (k) + G (k , 0 ) V 
s s s 


(C.28) 


where Y are the unfailed residuals in (C.5) when the input to the 
s 

filter is z (in (C.3)). 
s 


In the detectors we get 

k 

a d|s (k ' 6> "2 G'(3,0)V-h)Y s (j) 

j=e 


j—0 


/0)V 1 ( 3 ) tY (j) +G (j,0)v] 
as s 


* a a| s (k,9> + c a|s (k ' 9)u 


(C.29) 


where 


c a|s ik ' e > " 2>A«' e,v a 1( 3 >G s ( i' 9 > 

j=e 


(C.30) 


and d^j g was given in (C.8) , by which we can see that 


E<a a|s tk,e) ) “ c <a! s (k ' 0)v 


(C.31) 


The log- likelihood ratios for the failure V now becomes: 


*a| s ‘ k ' e > - a a| s ‘ k> 9 )c a 1 <k ' e)a a|s lk ' 6) 

= Ed d j g (k,0)+c d j s (k,0}V]'c" 1 (k,0) Cd d j s {k,0)4-c d | s (k f 0)v] 

= d'| g (k,0)C d 1 ( k ,0)d d | s (k,0 ) + 2V , C^| s (k,0)c“ 1 (k,e)d d | s (k,0) 
+ v ' c a|s (k,6)c d 1(k,0)c dls (k,0)v 


(C . 32) 
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Recognizing the first term as j s (k. , 0) in (C.ll) , with its expectation 

m (C.27) , and noticing that d,| has zero mean value (see (C.8)- (C.10) ) 

d|s 

we can write, 


E(Ji d | s (k,e)) = E(^,„(k,0)) 


d s 


-1 


+ VC', (k,0)C (k,0)C | (k,0)V 


d s 


dl s 


(C . 33) 


In analogy to the matched case, we call the non-centrality parameter 


(k,8) = v’C' . (k,0)C 1 (k,6)C , (k,0)V (C.34) 

d|s djs d djs 

2 

This expression is similar to the cross -detection 6 and can be re- 
arranged 

S d|s (k - e > - V'C i | s (k,8)c; :l (k,0) • X ■ Cj| s (k.e)v 

- t v 'cj| a <itr«)o" 1 (it,e)]c"J(k r 0) ic”h,e)c d | s (k,e)\)i 

- v d|s c V k, 9 ,v a|s (c - 35 ’ 


where 

v a[s “ c d 1 (k - 9 )c d|= (k - e)v " ' , a|s (R,e> 

is a transformed failure vector. 

Finally, the failure estimates can be seen to be 


(C. 36) 


9,i (k) = arg max £ (k,0) 
a|s g d(s 


(C . 37) 


and 
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v a|s <k> ' c i <k - 0 a|s (k))a d|s (k - e a|s <k)> 


Evaluating its expectation using (C.31) and (C.36), 


E(v a|s !k,) ' c a (k ' e a| s (w,E(d a| s (k ' e a|s (k »> 


” c a <k - 6 a| s «> c a|s (k ' e a| s (knv 


= v, | (K,Q) 
d s 
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phone or if you have an NTIS Deposit Ac- 
count or an American Express card order 
through TELEX The order desk number is 
(703) 557-4650 and the TELEX number is 
89-9405 

Thank you for your interest in NTIS We 
appreciate your order. 


METHOD OF PAYMENT 


D Charge my NTIS deposit account no 

□ Purchase order no. 

□ Check enclosed for $ 

□ Bill me Add $5 00 per order and sign below (Not avail- 
able outside North American continent ) 

□ Charge to my American Express Card account number 


NAME 

ADDRESS 

CITY STATE ZIP. 


Card expiration date 

Signature 

□ Airmail Services requested 

Clip and mail to 


National Technical Information Service 
US. DEPARTMENT OF COMMERCE 
Springfield. Va. 22 161 
(703) 557-4650 TELEX 89-9405 


Item Number 

Quantity 

Unit Price* 

Total Price 1 

Paper Copy 
(PC) 

Microfiche 

(MF) 



















. 


All prices subject to change The prices hub Total 

above are accurate as of 3/77 Additional Charge 

. Enter Grand Total 





Foreign Prices on Request J p=i 


l < 



